Microsoft-Windows-Performance-Recorder-Control

56 events across 1 channel

Event	Title	Channel	Sample
100	Perf_ExternalCallStart	Operational	N
101	Perf_ExternalCallStop	Operational	N
102	Loaded profile ProfileName from file FileName.	Operational	N
103	Perf_LoadProfileFromFileStop	Operational	N
104	Perf_LoadProfileFromStringStart	Operational	N
105	Perf_LoadProfileFromStringStop	Operational	N
106	Perf_AddProfileToCollectionStart	Operational	N
107	Perf_IsEqualProfileStart	Operational	N
108	Perf_IsEqualProfileStart108	Operational	N
109	Perf_AddProfileToCollectionStop	Operational	N
110	Perf_RemoveProfileFromCollectionStart	Operational	N
111	Perf_RemoveProfileFromCollectionStop	Operational	N
112	Perf_IsEqualProfileCollectionStop	Operational	N
113	Perf_IsEqualProfileCollectionStop113	Operational	N
114	Loaded trace merge properties TraceMergePropertyName from file FileName.	Operational	N
115	Perf_LoadTraceMergePropertiesFromFileStop	Operational	N
116	Perf_LoadTraceMergePropertiesFromStringStart	Operational	N
117	Perf_LoadTraceMergePropertiesFromStringStop	Operational	N
118	Perf_IsEqualTraceMergePropertiesStop	Operational	N
119	Perf_IsEqualTraceMergePropertiesStop119	Operational	N
120	A recording profile set is being started.	Operational	N
121	A recording profile set has been started.	Operational	N
122	A recording profile set is being updated.	Operational	N
123	A recording profile set has been updated.	Operational	N
124	A recording profile set is being cancelled.	Operational	N
125	A recording profile set has been cancelled.	Operational	N
126	A recording profile set is being saved as FileName.	Operational	N
127	A recording profile set has been saved.	Operational	N
128	A recording profile set is being stopped as FileName.	Operational	N
129	A recording profile set has been stopped.	Operational	N
130	Perf_QueryProfilesStart	Operational	N
131	Perf_QueryProfilesStop	Operational	N
132	An on/off recording operation is getting configured.	Operational	N
133	An on/off recording operation has been configured.	Operational	N
134	An on/off recording operation is getting disabled.	Operational	N
135	An on/off recording operation has been disabled.	Operational	N
136	Perf_QueryBuiltInProfilesStart	Operational	N
137	Perf_QueryBuiltInProfilesStop	Operational	N
138	Perf_ControlProgressHandlerBeginStart	Operational	N
139	Perf_ControlProgressHandlerBeginStop	Operational	N
140	Perf_ControlProgressHandlerUpdateStart	Operational	N
141	Perf_ControlProgressHandlerUpdateStop	Operational	N
142	Perf_ControlProgressHandlerEndStart	Operational	N
143	Perf_ControlProgressHandlerEndStop	Operational	N
144	Perf_StartShutdownProfilesStart	Operational	N
145	Perf_StartShutdownProfilesStop	Operational	N
146	Perf_UpdateShutdownProfilesStart	Operational	N
147	Perf_UpdateShutdownProfilesStop	Operational	N
148	Perf_MergeShutdownProfilesStart	Operational	N
149	Perf_MergeShutdownProfilesStop	Operational	N
150	CaptureState on a Provider failed.	Operational	N
151	Starting the following profiles: ProfileIds.	Operational	N
152	The following profile has been started (part SequenceNumber of TotalEvents).	Operational	N
153	Started a LoggingMode EventSessionType session named SessionName.	Operational	N
200	Error HResult logged from FileName:LineNumber (FunctionName).	Operational	N
201	Error HResult (Message) from FunctionName Line:LineNumber.	Operational	N

Event ID 100: Perf_ExternalCallStart

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_ExternalCall
Opcode: Start

Event ID 101: Perf_ExternalCallStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_ExternalCall
Opcode: Stop

Event ID 102: Loaded profile ProfileName from file FileName.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_LoadProfileFromFile
Opcode: Start

Description

Loaded profile ProfileName from file FileName.

Message #

Loaded profile %1 from file %2

Fields #

Name	Description
`ProfileName` UnicodeString
`FileName` UnicodeString

Event ID 103: Perf_LoadProfileFromFileStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_LoadProfileFromFile
Opcode: Stop

Event ID 104: Perf_LoadProfileFromStringStart

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_LoadProfileFromString
Opcode: Start

Event ID 105: Perf_LoadProfileFromStringStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_LoadProfileFromString
Opcode: Stop

Event ID 106: Perf_AddProfileToCollectionStart

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_AddProfileToCollection
Opcode: Start

Event ID 107: Perf_IsEqualProfileStart

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_IsEqualProfile
Opcode: Start

Event ID 108: Perf_IsEqualProfileStart108

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_IsEqualProfile
Opcode: Start

Event ID 109: Perf_AddProfileToCollectionStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_AddProfileToCollection
Opcode: Stop

Event ID 110: Perf_RemoveProfileFromCollectionStart

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_RemoveProfileFromCollection
Opcode: Start

Event ID 111: Perf_RemoveProfileFromCollectionStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_RemoveProfileFromCollection
Opcode: Stop

Event ID 112: Perf_IsEqualProfileCollectionStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_IsEqualProfileCollection
Opcode: Stop

Event ID 113: Perf_IsEqualProfileCollectionStop113

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_IsEqualProfileCollection
Opcode: Stop

Event ID 114: Loaded trace merge properties TraceMergePropertyName from file FileName.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_LoadTraceMergePropertiesFromFile
Opcode: Start

Description

Loaded trace merge properties TraceMergePropertyName from file FileName.

Message #

Loaded trace merge properties %1 from file %2

Fields #

Name	Description
`TraceMergePropertyName` UnicodeString
`FileName` UnicodeString

Event ID 115: Perf_LoadTraceMergePropertiesFromFileStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_LoadTraceMergePropertiesFromFile
Opcode: Stop

Event ID 116: Perf_LoadTraceMergePropertiesFromStringStart

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_LoadTraceMergePropertiesFromString
Opcode: Start

Event ID 117: Perf_LoadTraceMergePropertiesFromStringStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_LoadTraceMergePropertiesFromString
Opcode: Stop

Event ID 118: Perf_IsEqualTraceMergePropertiesStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_IsEqualTraceMergeProperties
Opcode: Stop

Event ID 119: Perf_IsEqualTraceMergePropertiesStop119

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_IsEqualTraceMergeProperties
Opcode: Stop

Event ID 120: A recording profile set is being started.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_StartProfiles
Opcode: Start

Description

A recording profile set is being started...

Message #

A recording profile set is being started...

Event ID 121: A recording profile set has been started.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_StartProfiles
Opcode: Stop

Description

A recording profile set has been started.

Message #

A recording profile set has been started.

Event ID 122: A recording profile set is being updated.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_UpdateProfiles
Opcode: Start

Description

A recording profile set is being updated...

Message #

A recording profile set is being updated...

Event ID 123: A recording profile set has been updated.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_UpdateProfiles
Opcode: Stop

Description

A recording profile set has been updated.

Message #

A recording profile set has been updated.

Event ID 124: A recording profile set is being cancelled.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_CancelProfiles
Opcode: Start

Description

A recording profile set is being cancelled...

Message #

A recording profile set is being cancelled...

Event ID 125: A recording profile set has been cancelled.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_CancelProfiles
Opcode: Stop

Description

A recording profile set has been cancelled.

Message #

A recording profile set has been cancelled.

Event ID 126: A recording profile set is being saved as FileName.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_SaveProfiles
Opcode: Start

Description

A recording profile set is being saved as FileName...

Message #

A recording profile set is being saved as %1...

Fields #

Name	Description
`FileName` UnicodeString

Event ID 127: A recording profile set has been saved.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_SaveProfiles
Opcode: Stop

Description

A recording profile set has been saved.

Message #

A recording profile set has been saved.

Event ID 128: A recording profile set is being stopped as FileName.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_StopProfiles
Opcode: Start

Description

A recording profile set is being stopped as FileName...

Message #

A recording profile set is being stopped as %1...

Fields #

Name	Description
`FileName` UnicodeString

Event ID 129: A recording profile set has been stopped.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_StopProfiles
Opcode: Stop

Description

A recording profile set has been stopped.

Message #

A recording profile set has been stopped.

Event ID 130: Perf_QueryProfilesStart

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_QueryProfiles
Opcode: Start

Event ID 131: Perf_QueryProfilesStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_QueryProfiles
Opcode: Stop

Event ID 132: An on/off recording operation is getting configured.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_EnableBootTracing
Opcode: Start

Description

An on/off recording operation is getting configured...

Message #

An on/off recording operation is getting configured...

Event ID 133: An on/off recording operation has been configured.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_EnableBootTracing
Opcode: Stop

Description

An on/off recording operation has been configured.

Message #

An on/off recording operation has been configured.

Event ID 134: An on/off recording operation is getting disabled.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_DisableBootTracing
Opcode: Start

Description

An on/off recording operation is getting disabled...

Message #

An on/off recording operation is getting disabled...

Event ID 135: An on/off recording operation has been disabled.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_DisableBootTracing
Opcode: Stop

Description

An on/off recording operation has been disabled.

Message #

An on/off recording operation has been disabled.

Event ID 136: Perf_QueryBuiltInProfilesStart

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_QueryBuiltInProfiles
Opcode: Start

Event ID 137: Perf_QueryBuiltInProfilesStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_QueryBuiltInProfiles
Opcode: Stop

Event ID 138: Perf_ControlProgressHandlerBeginStart

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_ControlProgressHandlerBegin
Opcode: Start

Event ID 139: Perf_ControlProgressHandlerBeginStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_ControlProgressHandlerBegin
Opcode: Stop

Event ID 140: Perf_ControlProgressHandlerUpdateStart

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_ControlProgressHandlerUpdate
Opcode: Start

Event ID 141: Perf_ControlProgressHandlerUpdateStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_ControlProgressHandlerUpdate
Opcode: Stop

Event ID 142: Perf_ControlProgressHandlerEndStart

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_ControlProgressHandlerEnd
Opcode: Start

Event ID 143: Perf_ControlProgressHandlerEndStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_ControlProgressHandlerEnd
Opcode: Stop

Event ID 144: Perf_StartShutdownProfilesStart

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_StartShutdownProfiles
Opcode: Start

Event ID 145: Perf_StartShutdownProfilesStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_StartShutdownProfiles
Opcode: Stop

Event ID 146: Perf_UpdateShutdownProfilesStart

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_UpdateShutdownProfiles
Opcode: Start

Event ID 147: Perf_UpdateShutdownProfilesStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_UpdateShutdownProfiles
Opcode: Stop

Event ID 148: Perf_MergeShutdownProfilesStart

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_MergeShutdownProfiles
Opcode: Start

Fields #

Name	Description
`FileName` UnicodeString

Event ID 149: Perf_MergeShutdownProfilesStop

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_MergeShutdownProfiles
Opcode: Stop

Event ID 150: CaptureState on a Provider failed.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_CaptureState

Description

CaptureState on a Provider failed.

Message #

CaptureState on a Provider failed.

Provider	: %1
Error	: %2

Fields #

Name	Description
`Provider` UnicodeString
`Error` UnicodeString

Event ID 151: Starting the following profiles: ProfileIds.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_WPRProfileIds

Description

Starting the following profiles: ProfileIds.

Message #

Starting the following profiles: %1

Fields #

Name	Description
`ProfileIds` UnicodeString

Event ID 152: The following profile has been started (part SequenceNumber of TotalEvents).

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_WPRProfileXml

Description

The following profile has been started (part SequenceNumber of TotalEvents).

Message #

The following profile has been started (part %1 of %2):
%3

%6

Fields #

Name	Description
`SequenceNumber` UInt8
`TotalEvents` UInt8
`LoggingMode` UInt8
`DetailLevel` UInt8
`Length` UInt16
`ProfileXml` AnsiString

Event ID 153: Started a LoggingMode EventSessionType session named SessionName.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Perf_SessionName

Description

Started a LoggingMode EventSessionType session named SessionName.

Message #

Started a %2 %3 session named %1

Fields #

Name	Description
`SessionName` UnicodeString
`LoggingMode` UInt8
`EventSessionType` UInt8

Event ID 200: Error HResult logged from FileName:LineNumber (FunctionName).

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Debug_WPRCControl

Description

Error HResult logged from FileName:LineNumber (FunctionName).

Message #

Error %3 logged from %5:%4 (%6)

Fields #

Name	Description
`DebugType` UInt32
`ObjectType` UInt32
`HResult` Int32
`LineNumber` UInt32
`FileName` UnicodeString
`FunctionName` UnicodeString

Event ID 201: Error HResult (Message) from FunctionName Line:LineNumber.

Provider: Microsoft-Windows-Performance-Recorder-Control
Channel: Operational
Task: Debug_PrintHr

Description

Error HResult (Message) from FunctionName Line:LineNumber.

Message #

Error %1 (%2) from %3 Line:%4

Fields #

Name	Description
`HResult` Int32
`Message` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 36b6f488-aad7-48c2-afe3-d4ec2c8b46fa

Defined in windowsperformancerecordercontrol.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4405, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)