detection.wiki

Microsoft-Windows-RTWorkQueue-Extended

EventTitleChannelSampleRule
1WorkQueue Queue extended: AsyncResult=AsyncResult …RTWorkQueueExtendedNN
2WorkQueue Extended LongRunning: RefCount workQueueID=WorkQueueID …RTWorkQueueExtendedNN
3WorkQueue extended InvalidUsageAttempt: Platform=Platform …RTWorkQueueExtendedNN
4WorkQueue extended InvalidCallbackAttempt: Platform=Platform Callback=Callback …RTWorkQueueExtendedNN
5WorkQueue Extended PlatformRef: Start platform=object.RTWorkQueueExtendedYN
6WorkQueue Extended PlatformRef: Stop platform=object.RTWorkQueueExtendedNN
7WorkQueue Extended PlatformRef: ref platform=object ref:Count.RTWorkQueueExtendedYN
8WorkQueue Extended RTLock: Start workQueueID=WorkQueueID.RTWorkQueueExtendedNN
9WorkQueue Extended RTLock: Stop workQueueID=WorkQueueID.RTWorkQueueExtendedNN
10WorkQueue Extended SetAVMode: Start group=handle mode=Mode.RTWorkQueueExtendedNN
11WorkQueue Extended SetAVMode: Stop group=handle mode=Mode.RTWorkQueueExtendedNN
12WorkQueue Extended RTLockAcquire: Start workQueueID=WorkQueueID.RTWorkQueueExtendedNN
13WorkQueue Extended RTLockAcquire: Stop workQueueID=WorkQueueID.RTWorkQueueExtendedNN
14WorkQueue Extended TimerCallback: Start object=workqueue id=WorkQueueID …RTWorkQueueExtendedNN
15WorkQueue Extended TimerCallback: Stop object=workqueue id=WorkQueueID …RTWorkQueueExtendedNN
16WorkQueue TimerMode: Set workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID …RTWorkQueueExtendedNN
17WorkQueue TimerSet: Set workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID …RTWorkQueueExtendedNN
18WorkQueue Extended TimerResChange: Start object=workqueue id=WorkQueueID …RTWorkQueueExtendedNN
19WorkQueue Extended TimerResChange: Stop object=workqueue id=WorkQueueID …RTWorkQueueExtendedNN
20WorkQueue Extended Lock: object=workqueue.RTWorkQueueExtendedNN
21WorkQueue Extended Unlock: object=workqueue.RTWorkQueueExtendedNN
22WorkQueue Extended Lock RefCount: object=workqueue extRefCount=ExtRefCount …RTWorkQueueExtendedNN
24WorkQueue extended MismatchedCallbackQueues: Platform=Platform Callback=Callback …RTWorkQueueExtendedNN

Event ID 1: WorkQueue Queue extended: AsyncResult=AsyncResult AsyncResultVTable=AsyncResultVTable.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:QueueExtended

Message #

WorkQueue Queue extended: AsyncResult=%1 AsyncResultVTable=%2

Fields #

NameDescription
AsyncResult Pointer
AsyncResultVTable Pointer

Event ID 2: WorkQueue Extended LongRunning: RefCount workQueueID=WorkQueueID refcount=RefCount.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:ExtendedLongRunning

Message #

WorkQueue Extended LongRunning: RefCount workQueueID=%1 refcount=%2

Fields #

NameDescription
WorkQueueID UInt32
RefCount UInt32

Event ID 3: WorkQueue extended InvalidUsageAttempt: Platform=Platform WorkQueueID=WorkQueueID PrivateQueueIndex=WorkPrivateIndex.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:ExtendedInvalidUsageAttempt

Message #

WorkQueue extended InvalidUsageAttempt: Platform=%1 WorkQueueID=%2 PrivateQueueIndex=%3

Fields #

NameDescription
Platform Pointer
WorkQueueID UInt32
WorkPrivateIndex UInt32

Event ID 4: WorkQueue extended InvalidCallbackAttempt: Platform=Platform Callback=Callback WorkQueueID=WorkQueueID.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:ExtendedInvalidCallbackAttempt

Message #

WorkQueue extended InvalidCallbackAttempt: Platform=%1 Callback=%2 WorkQueueID=%3

Fields #

NameDescription
Platform Pointer
Callback Pointer
WorkQueueID UInt32

Event ID 5: WorkQueue Extended PlatformRef: Start platform=object.

#
Channel
RTWorkQueueExtended
Level
Verbose
Task
WorkQueue:PlatformRef
Opcode
Start

Message #

WorkQueue Extended PlatformRef: Start platform=%1

Fields #

NameDescription
object Pointer

Example Event #

{
  "system": {
    "channel": "RTWorkQueueExtended",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 5,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 9624,
      "thread_id": 5320
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-RTWorkQueue-Extended",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:46:39.452Z",
    "version": 0
  },
  "event_data": {
    "object": "0x7FFE90CA1780"
  },
  "message": ""
}

Event ID 6: WorkQueue Extended PlatformRef: Stop platform=object.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:PlatformRef
Opcode
Stop

Message #

WorkQueue Extended PlatformRef: Stop platform=%1

Fields #

NameDescription
object Pointer

Event ID 7: WorkQueue Extended PlatformRef: ref platform=object ref:Count.

#
Channel
RTWorkQueueExtended
Level
Verbose
Task
WorkQueue:PlatformRef

Message #

WorkQueue Extended PlatformRef: ref platform=%1 ref:%2

Fields #

NameDescription
object Pointer
Count Int32

Example Event #

{
  "system": {
    "channel": "RTWorkQueueExtended",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 7,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 9624,
      "thread_id": 5320
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-RTWorkQueue-Extended",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:46:39.452Z",
    "version": 0
  },
  "event_data": {
    "Count": 1,
    "object": "0x7FFE90CA1780"
  },
  "message": ""
}

Event ID 8: WorkQueue Extended RTLock: Start workQueueID=WorkQueueID.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:RTLock
Opcode
Start

Message #

WorkQueue Extended RTLock: Start workQueueID=%1

Fields #

NameDescription
WorkQueueID UInt32

Event ID 9: WorkQueue Extended RTLock: Stop workQueueID=WorkQueueID.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:RTLock
Opcode
Stop

Message #

WorkQueue Extended RTLock: Stop workQueueID=%1

Fields #

NameDescription
WorkQueueID UInt32

Event ID 10: WorkQueue Extended SetAVMode: Start group=handle mode=Mode.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:SetAVMode
Opcode
Start

Message #

WorkQueue Extended SetAVMode: Start group=%1 mode=%2

Fields #

NameDescription
handle Pointer
Mode UInt32

Event ID 11: WorkQueue Extended SetAVMode: Stop group=handle mode=Mode.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:SetAVMode
Opcode
Stop

Message #

WorkQueue Extended SetAVMode: Stop group=%1 mode=%2

Fields #

NameDescription
handle Pointer
Mode UInt32

Event ID 12: WorkQueue Extended RTLockAcquire: Start workQueueID=WorkQueueID.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:RTLockAcquire
Opcode
Start

Message #

WorkQueue Extended RTLockAcquire: Start workQueueID=%1

Fields #

NameDescription
WorkQueueID UInt32

Event ID 13: WorkQueue Extended RTLockAcquire: Stop workQueueID=WorkQueueID.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:RTLockAcquire
Opcode
Stop

Message #

WorkQueue Extended RTLockAcquire: Stop workQueueID=%1

Fields #

NameDescription
WorkQueueID UInt32

Event ID 14: WorkQueue Extended TimerCallback: Start object=workqueue id=WorkQueueID mode=Mode.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:TimerCallback
Opcode
Start

Message #

WorkQueue Extended TimerCallback: Start object=%1 id=%2 mode=%3

Fields #

NameDescription
workqueue Pointer
WorkQueueID UInt32
Mode UInt32

Event ID 15: WorkQueue Extended TimerCallback: Stop object=workqueue id=WorkQueueID mode=Mode.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:TimerCallback
Opcode
Stop

Message #

WorkQueue Extended TimerCallback: Stop object=%1 id=%2 mode=%3

Fields #

NameDescription
workqueue Pointer
WorkQueueID UInt32
Mode UInt32

Event ID 16: WorkQueue TimerMode: Set workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Mode=OldMode.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:TimerMode

Message #

WorkQueue TimerMode: Set workqueue_ptr=%1 workQueueID=%2 Mode=%3

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
OldMode UInt32
NewMode UInt32

Event ID 17: WorkQueue TimerSet: Set workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Delta=Mode.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:TimerSet

Message #

WorkQueue TimerSet: Set workqueue_ptr=%1 workQueueID=%2 Delta=%3

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
Mode UInt32
Delta UInt32

Event ID 18: WorkQueue Extended TimerResChange: Start object=workqueue id=WorkQueueID mode=Resolution.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:TimerResChange
Opcode
Start

Message #

WorkQueue Extended TimerResChange: Start object=%1 id=%2 mode=%3

Fields #

NameDescription
workqueue Pointer
WorkQueueID UInt32
Resolution UInt32

Event ID 19: WorkQueue Extended TimerResChange: Stop object=workqueue id=WorkQueueID mode=Resolution.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:TimerResChange
Opcode
Stop

Message #

WorkQueue Extended TimerResChange: Stop object=%1 id=%2 mode=%3

Fields #

NameDescription
workqueue Pointer
WorkQueueID UInt32
Resolution UInt32

Event ID 20: WorkQueue Extended Lock: object=workqueue.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:Lock
Opcode
Start

Message #

WorkQueue Extended Lock: object=%1

Fields #

NameDescription
workqueue Pointer

Event ID 21: WorkQueue Extended Unlock: object=workqueue.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:Lock
Opcode
Stop

Message #

WorkQueue Extended Unlock: object=%1

Fields #

NameDescription
workqueue Pointer

Event ID 22: WorkQueue Extended Lock RefCount: object=workqueue extRefCount=ExtRefCount IntRefCount=IntRefCount.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:Lock

Message #

WorkQueue Extended Lock RefCount: object=%1 extRefCount=%2 IntRefCount=%3

Fields #

NameDescription
workqueue Pointer
ExtRefCount UInt32
IntRefCount UInt32

Event ID 24: WorkQueue extended MismatchedCallbackQueues: Platform=Platform Callback=Callback WorkQueueID=WorkQueueID CallbackWorkQueue=CallbackWorkQueueID.

#
Channel
RTWorkQueueExtended
Task
WorkQueue:ExtendedMismatchedCallbackQueues

Message #

WorkQueue extended MismatchedCallbackQueues: Platform=%1 Callback=%2 WorkQueueID=%3 CallbackWorkQueue=%4

Fields #

NameDescription
Platform Pointer
Callback Pointer
WorkQueueID UInt32
CallbackWorkQueueID UInt32

Provenance

ETW provider GUID 83faaa86-63c8-4dd8-a2da-fbadddfc0655

Defined in rtworkq.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3912, captured 2026-06-02 — Manifest XML pack, 2.0 MB