detection.wiki

Microsoft-Windows-OneBackup

EventTitleChannelSampleRule
1000Message.DebugNN
1001Message.DebugNN
1002Message.DebugNN

Event ID 1000: Message.

#
Channel
Debug

Message #

%1

Fields #

NameDescription
Message UnicodeString

Event ID 1001: Message.

#
Channel
Debug

Message #

%1

Fields #

NameDescription
Message UnicodeString

Event ID 1002: Message.

#
Channel
Debug

Message #

%1

Fields #

NameDescription
Message UnicodeString

Provenance

ETW provider GUID 72561cf0-c85c-4f78-9e8d-cba9093df62d

Defined in OneBackupHandler.dll, which carries the event manifest.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB