detection.wiki

Microsoft-Windows-Runtime-Graphics

EventTitleChannelSampleRule
1DisplayPropertiesAnalyticNN
2DisplayProperties2AnalyticNN
3DisplayProperties3AnalyticNN

Event ID 1: DisplayProperties

#
Channel
Analytic
Task
DisplayProperties

Fields #

NameDescription
WnfStateNameData0 UInt32
WnfStateNameData1 UInt32

Event ID 2: DisplayProperties2

#
Channel
Analytic
Task
DisplayProperties

Event ID 3: DisplayProperties3

#
Channel
Analytic
Task
DisplayProperties

Provenance

ETW provider GUID fa5cf675-72eb-49e2-b447-de5552faff1c

Defined in Windows.Graphics.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB