detection.wiki

Microsoft-Windows-Processor-Aggregator

EventTitleChannelSampleRule
1LogicalProcessorIdlingPUROperationalNN
2LogicalProcessorIdlingOSTOperationalNN

Event ID 1: LogicalProcessorIdlingPUR

#
Channel
Operational
Task
LogicalProcessorIdlingPUR

Fields #

NameDescription
NumProcessors UInt32

Event ID 2: LogicalProcessorIdlingOST

#
Channel
Operational
Task
LogicalProcessorIdlingOST

Fields #

NameDescription
Requested UInt32
Acknowledged UInt32
IsSuccess Boolean

Provenance

ETW provider GUID cba16cf2-2fab-49f8-89ae-894e718649e7

Defined in microsoft-windows-processor-aggregator-events.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB