Microsoft-Windows-Network-ExecutionContext
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | Nic IfGuid (IfName) executed more than TimeWarningInSec miliseconds continuously … | System | N | N |
| 2 | Task_SchedulingOpcode_StateChange | Operational | N | N |
| 3 | Task_SchedulingOpcode_StateChange3 | Operational | N | N |
| 4 | Task_SchedulingOpcode_StateChange4 | Operational | N | N |
| 5 | Task_SchedulingOpcode_StateChange5 | Operational | N | N |
| 6 | Task_SchedulingOpcode_StateChange6 | Operational | N | N |
| 7 | Task_SchedulingOpcode_StateChange7 | Operational | N | N |
Event ID 1: Nic IfGuid (IfName) executed more than TimeWarningInSec miliseconds continuously at DISPATCH for ExceededCount times in last LastIntervalInSec miliseconds.
#Event ID 2: Task_SchedulingOpcode_StateChange
#Fields #
| Name | Description |
|---|---|
Identifier GUID | |
Reason UInt32 | |
PreviousState UInt32 | |
NewState UInt32 | |
TaskCounter UInt32 | |
IterationCounter UInt64 | |
WorkCounter UInt64 | |
Name CountedUtf16String | |
Dispatcher UInt64 |
Event ID 3: Task_SchedulingOpcode_StateChange3
#Fields #
| Name | Description |
|---|---|
Dispatcher UInt64 | |
Reason UInt32 | |
PreviousState UInt32 | |
NewState UInt32 |
Event ID 4: Task_SchedulingOpcode_StateChange4
#Fields #
| Name | Description |
|---|---|
Dispatcher UInt64 | |
Header UInt64 | |
Object UInt64 | |
Priority UInt32 |
Event ID 5: Task_SchedulingOpcode_StateChange5
#Fields #
| Name | Description |
|---|---|
Dispatcher UInt64 | |
Header UInt64 | |
Object UInt64 | |
Priority UInt32 |
Provenance
ETW provider GUID 0075e1ab-e1d1-5d1f-35f5-da36fb4f41b1
Defined in ExecutionContext.sys, the binary that emits these events.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4647, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB