detection.wiki

Microsoft-Windows-Recovery

EventTitleChannelSampleRule
1003Recovery (in Control Panel) has initiated a recovery operation.OperationalNN
1004The recovery operation initiated by Recovery (in Control Panel) has completed …OperationalNN
1005The recovery operation initiated by Recovery (in Control Panel) failed to …OperationalNN
1006Recovery (in Control Panel) failed to open because of an error.OperationalNN

Event ID 1003: Recovery (in Control Panel) has initiated a recovery operation.

#
Channel
Operational

Event ID 1004: The recovery operation initiated by Recovery (in Control Panel) has completed successfully.

#
Channel
Operational

Event ID 1005: The recovery operation initiated by Recovery (in Control Panel) failed to complete.

#
Channel
Operational

Event ID 1006: Recovery (in Control Panel) failed to open because of an error.

#
Channel
Operational