Microsoft-Windows-SEC
Not an independently readable Windows event log. Microsoft-Windows-SEC is an ETW trace provider defined in mssecflt.sys, the Microsoft Defender for Endpoint kernel sensor: its events are delivered to a realtime trace session the sensor consumes, and surface as the Defender Advanced Hunting Device* tables (see /defender/). The manifest declares an Operational channel, but Windows registers no readable Event Log channel for it, so nothing here appears in Event Viewer or forwards over WEF. The event and field names below are manifest-derived. Present only where Microsoft Defender for Endpoint is onboarded.
| Event | Title | Sample | Rule |
|---|---|---|---|
| 1 | task_0 | N | N |
| 2 | task_02 | N | N |
| 3 | task_03 | N | N |
| 4 | task_04 | N | N |
| 5 | task_05_V1 | N | N |
| 6 | task_06_V1 | N | N |
| 7 | task_07_V1 | N | N |
| 8 | task_08 | N | N |
| 9 | task_09 | N | N |
| 10 | task_010 | N | N |
| 11 | task_011 | N | N |
| 12 | task_012 | N | N |
| 13 | task_013 | N | N |
| 14 | task_014 | N | N |
| 15 | task_015 | N | N |
| 16 | task_016 | N | N |
| 17 | task_017 | N | N |
| 18 | task_018 | N | N |
| 19 | task_019 | N | N |
| 20 | task_020 | N | N |
| 21 | task_021 | N | N |
| 22 | task_022 | N | N |
| 23 | task_023 | N | N |
| 24 | task_024 | N | N |
| 25 | task_025 | N | N |
| 26 | task_026 | N | N |
| 27 | task_027 | N | N |
| 28 | task_028 | N | N |
| 29 | task_029 | N | N |
| 30 | task_030 | N | N |
| 31 | task_031 | N | N |
| 32 | task_032 | N | N |
| 33 | task_033 | N | N |
| 34 | task_034 | N | N |
| 35 | task_035 | N | N |
| 36 | task_036 | N | N |
| 37 | task_037 | N | N |
| 38 | task_038 | N | N |
| 39 | task_039 | N | N |
| 40 | task_040 | N | N |
| 41 | task_041 | N | N |
| 42 | task_042_V2 | N | N |
| 43 | task_043_V1 | N | N |
| 44 | task_044 | N | N |
| 45 | task_045 | N | N |
| 46 | task_046 | N | N |
| 47 | task_047 | N | N |
| 48 | task_048 | N | N |
| 49 | task_049 | N | N |
| 50 | task_050_V2 | N | N |
| 51 | task_051_V1 | N | N |
| 52 | task_052_V2 | N | N |
| 53 | task_053 | N | N |
| 54 | task_054 | N | N |
| 55 | task_055 | N | N |
| 56 | task_056_V2 | N | N |
| 57 | task_057_V2 | N | N |
| 58 | task_058 | N | N |
| 59 | task_059 | N | N |
| 60 | task_060 | N | N |
| 61 | task_061 | N | N |
Event ID 1: task_0
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
CreatorProcessId HexInt32 | |
CreatorProcessTime Int64 | |
CreatorProcessName UnicodeString | |
ProcessName UnicodeString | |
CommandLine UnicodeString | |
ImageSHA256 Binary | |
ImageSHA1 Binary | |
ImageMD5 Binary | |
PartialCRC1 HexInt32 | |
PartialCRC2 HexInt32 | |
PartialCRC3 HexInt32 | |
MotW Boolean | |
IntegrityLevel HexInt32 | |
TokenElevationType HexInt32 | Token elevation type (1=Default, 2=Full, 3=Limited). Known values
|
Elevated Boolean | |
Impersonation Boolean | |
SubjectLogonId HexInt64 | Logon session identifier (LUID) for the subject. Correlates with logon events (4624). |
ProcessStartKey UInt64 | |
CreatorProcessStartKey UInt64 | |
CommandLineTruncated Boolean | |
CommandLineSize HexInt32 | |
ImageLSH Binary | |
MitigationPolicy UInt64 | |
ProtectionLevel UInt8 | |
EnterprisePolicy HexInt32 | |
InferredParentProcessId HexInt32 | |
InferredParentProcessTime Int64 | |
InferredParentProcessName UnicodeString | |
InferredParentProcessStartKey UInt64 | |
CiIsSigningChainValid UInt32 | |
CiIsMicrosoftRoot UInt32 | |
CiIsMicrosoftApplicationRoot UInt32 | |
CiSigningLevel UInt8 | |
ImageOriginalName UnicodeString | |
CreationAnomalies UInt64 | |
InitialThreadId HexInt32 | |
InitialThreadStartAddress Pointer | |
WindowFlags HexInt32 | |
ShowWindowFlags HexInt32 | |
StandardInputDeviceType HexInt32 | |
StandardOutputDeviceType HexInt32 | |
StandardErrorDeviceType HexInt32 | |
DesktopInfo UnicodeString |
Event ID 4: task_04
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
FileName UnicodeString | |
FileAttributes HexInt32 | |
Dispositon HexInt32 | |
ProcessStartKey UInt64 | |
RequestSource UInt8 | |
ShareName UnicodeString | |
RemoteIpAddressLength UInt32 | |
RemoteIpAddress Binary |
Event ID 5: task_05_V1
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
FileName UnicodeString | |
NewFileName UnicodeString | |
FileAttributes HexInt32 | |
ProcessStartKey UInt64 | |
RequestSource UInt8 | |
ShareName UnicodeString | |
RemoteIpAddressLength UInt32 | |
RemoteIpAddress Binary |
Event ID 6: task_06_V1
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
FileName UnicodeString | |
FileAttributes HexInt32 | |
ProcessStartKey UInt64 | |
IsSensitive Boolean | |
RequestSource UInt8 | |
ShareName UnicodeString | |
RemoteIpAddressLength UInt32 | |
RemoteIpAddress Binary |
Event ID 7: task_07_V1
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
FileName UnicodeString | |
FileAttributes HexInt32 | |
ProcessStartKey UInt64 | |
IsSensitive Boolean | |
RequestSource UInt8 | |
ShareName UnicodeString | |
RemoteIpAddressLength UInt32 | |
RemoteIpAddress Binary |
Event ID 8: task_08
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
Key UnicodeString | |
ProcessStartKey UInt64 |
Event ID 9: task_09
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
Key UnicodeString | |
ProcessStartKey UInt64 |
Event ID 10: task_010
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
Key UnicodeString | |
NewKey UnicodeString | |
ProcessStartKey UInt64 |
Event ID 11: task_011
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
Key UnicodeString | |
Hive UnicodeString | |
RestoreFlags HexInt32 | |
ProcessStartKey UInt64 |
Event ID 12: task_012
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
Key UnicodeString | |
Hive UnicodeString | |
NewHive UnicodeString | |
ProcessStartKey UInt64 |
Event ID 13: task_013
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
Key UnicodeString | |
Value UnicodeString | |
OldValueDataType HexInt32 | |
OldValueDataSize HexInt32 | |
OldValueCopiedSize UInt32 | |
OldValueData Binary | |
NewValueDataType HexInt32 | |
NewValueDataSize HexInt32 | |
NewValueCopiedSize UInt32 | |
NewValueData Binary | |
ProcessStartKey UInt64 |
Event ID 14: task_014
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
VolumeName UnicodeString | |
VolReadOffset HexInt64 | |
VolReadSize HexInt64 | |
SystemVolume Boolean | |
ProcessStartKey UInt64 | |
VolumeShadowCopy Boolean |
Event ID 15: task_015
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
VolumeName UnicodeString | |
AccessMask HexInt32 | Access mask reference |
SystemVolume Boolean | |
ProcessStartKey UInt64 | |
VolumeShadowCopy Boolean |
Event ID 16: task_016
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
Key UnicodeString | |
Value UnicodeString | |
DataType HexInt32 | |
ValueDataSize HexInt32 | |
ValueCopiedSize UInt32 | |
ValueData Binary | |
ProcessStartKey UInt64 |
Event ID 17: task_017
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
PipeName UnicodeString | |
RemoteClientsAccess UInt32 | |
NamedPipeEnd UInt32 | |
DesiredAccess HexInt32 | Process access rights reference |
FileOperation UInt32 | |
ProcessStartKey UInt64 | |
ShareName UnicodeString | |
RemoteIpAddressLength UInt32 | |
RemoteIpAddress Binary |
Event ID 18: task_018
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
TargetProcessId HexInt32 | Process ID of the target process. |
TargetProcessTime Int64 | |
TargetProcessName UnicodeString | |
TargetThreadId HexInt32 | Thread ID in the target process. |
TargetThreadStartAddress Pointer | |
StartAddressVadQueryResult UInt32 | |
StartAddressVadAllocationBase Pointer | |
StartAddressVadAllocationProtect UInt32 | |
StartAddressVadRegionType UInt32 | |
StartAddressVadRegionSize Pointer | |
StartAddressVadProtect UInt32 | |
SourceProcessStartKey UInt64 | |
TargetProcessStartKey UInt64 | Kernel-assigned unique key for the target process. |
MappedModuleName UnicodeString |
Event ID 19: task_019
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
TargetProcessId HexInt32 | Process ID of the target process. |
TargetProcessTime Int64 | |
TargetProcess UnicodeString | |
Access HexInt32 | |
SourceProcessStartKey UInt64 | |
TargetProcessStartKey UInt64 | Kernel-assigned unique key for the target process. |
Event ID 20: task_020
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
Desktop UnicodeString | |
Access HexInt32 | |
Duplicate Boolean | |
Kernel Boolean | |
ProcessStartKey UInt64 |
Event ID 21: task_021
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
VolumeName UnicodeString | |
VolWriteOffset HexInt64 | |
VolWriteSize HexInt64 | |
SystemVolume Boolean | |
ProcessStartKey UInt64 | |
VolumeShadowCopy Boolean |
Event ID 22: task_022
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
ProcessName UnicodeString | |
CommandLine UnicodeString | |
ProcessStartKey UInt64 | |
CommandLineTruncated Boolean | |
CommandLineSize HexInt32 |
Event ID 23: task_023
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
ImageName UnicodeString | |
MotW Boolean | |
ImageSHA256 Binary | |
ImageSHA1 Binary | |
ImageMD5 Binary | |
PartialCRC1 HexInt32 | |
PartialCRC2 HexInt32 | |
PartialCRC3 HexInt32 | |
SystemModeImage Boolean | |
LoadImageAddress Pointer | |
ProcessStartKey UInt64 | |
LoadImageSize UInt64 | |
ImageLSH Binary | |
CiIsSigningChainValid UInt32 | |
CiIsMicrosoftRoot UInt32 | |
CiIsMicrosoftApplicationRoot UInt32 | |
CiSigningLevel UInt8 | |
ImageOriginalName UnicodeString | |
ImageSignatureLevel UInt32 | |
ImageDeviceType UInt32 | |
ImageDeviceCharacteristics UInt32 | |
ImageDeviceFlags UInt32 |
Event ID 24: task_024
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
ImageName UnicodeString | |
MotW Boolean | |
ImageSHA256 Binary | |
ImageSHA1 Binary | |
ImageMD5 Binary | |
PartialCRC1 HexInt32 | |
PartialCRC2 HexInt32 | |
PartialCRC3 HexInt32 | |
ImageSignatureLevel UInt32 | |
ImageSignatureType UInt32 | |
CurrentCodeIntegrityOptions UInt32 | |
OriginalCodeIntegrityOptions UInt32 | |
ProcessStartKey UInt64 | |
ImageBase Pointer | |
ImageSize UInt64 | |
ImageLSH Binary |
Event ID 25: task_025
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
AffectedProcessId HexInt32 | |
AffectedProcessTime Int64 | |
CurrentTokenPointer Pointer | |
CurrentTokenSource Binary | |
CurrentTokenPrivPresent UInt64 | |
CurrentTokenPrivEnabled UInt64 | |
CurrentTokenPrivEnabledByDefault UInt64 | |
CurrentTokenIntegrityLevel UInt32 | |
CurrentTokenUserSid SID | |
PreviousTokenPointer Pointer | |
PreviousTokenSource Binary | |
PreviousTokenPrivPresent UInt64 | |
PreviousTokenPrivEnabled UInt64 | |
PreviousTokenPrivEnabledByDefault UInt64 | |
PreviousTokenIntegrityLevel UInt32 | |
PreviousTokenUserSid SID | |
OriginalTokenPointer Pointer | |
OriginalTokenSource Binary | |
OriginalTokenPrivPresent UInt64 | |
OriginalTokenPrivEnabled UInt64 | |
OriginalTokenPrivEnabledByDefault UInt64 | |
OriginalTokenIntegrityLevel UInt32 | |
OriginalTokenUserSid SID | |
SystemTokenPointer Pointer | |
InlineCheck Boolean | |
AffectedProcessStartKey UInt64 | |
PrimaryTokenFrozen Boolean | |
ParentTokenIntegrityLevel UInt32 |
Event ID 26: task_026
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ProcessStartKey UInt64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
NormalizedSharePath UnicodeString | |
ShareName UnicodeString | |
SocketAddress UnicodeString | |
OpenDirection UInt8 |
Event ID 27: task_027
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
AffectedProcessId HexInt32 | |
AffectedProcessStartKey UInt64 | |
AffectedProcessTime Int64 | |
InlineCheck Boolean | |
CurrentDaclPointer Pointer | |
CurrentDaclValidAceList Boolean | |
CurrentDaclAceCount UInt32 | |
CurrentDaclSids UnicodeString | |
CurrentDaclAccessMaskBlobSize UInt32 | |
CurrentDaclAccessMasks Binary | |
PreviousDaclPointer Pointer | |
PreviousDaclValidAceList Boolean | |
PreviousDaclAceCount UInt32 | |
PreviousDaclSids UnicodeString | |
PreviousDaclAccessMaskBlobSize UInt32 | |
PreviousDaclAccessMasks Binary | |
OriginalDaclPointer Pointer | |
OriginalDaclValidAceList Boolean | |
OriginalDaclAceCount UInt32 | |
OriginalDaclSids UnicodeString | |
OriginalDaclAccessMaskBlobSize UInt32 | |
OriginalDaclAccessMasks Binary |
Event ID 28: task_028
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessStartKey UInt64 | |
Flags UInt32 | |
ThreadId HexInt32 | |
CallerAddress Pointer | |
StartAddress Pointer | |
BackTraceSize UInt32 | |
BackTrace Binary | |
TargetCodeSize UInt32 | |
TargetCode Binary | |
CallerCodeSize UInt32 | |
CallerCode Binary |
Event ID 29: task_029
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
CurrentValue Pointer | |
OriginalValue Pointer | |
IsSynchronous Boolean |
Event ID 30: task_030
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
CurrentValue Pointer | |
PreviousValue Pointer | |
OriginalValue Pointer | |
IsSynchronous Boolean |
Event ID 31: task_031
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ProcessStartKey UInt64 | |
ThreadId HexInt32 | |
UserSid SID | |
RequestSource UInt8 | |
ShareName UnicodeString | |
RemoteIpAddressLength UInt32 | |
RemoteIpAddress Binary |
Event ID 32: task_032
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
SuspiciousPointerIndex UInt32 | |
TableSize UInt32 | |
Table Binary | |
CodeSize UInt32 | |
Code Binary |
Event ID 33: task_033
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
SuspiciousPointerIndex UInt32 | |
TableSize UInt32 | |
Table Binary | |
CodeSize UInt32 | |
Code Binary |
Event ID 34: task_034
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
TargetProcessId HexInt32 | Process ID of the target process. |
TargetProcessTime Int64 | |
TargetProcess UnicodeString | |
Access HexInt32 | |
SourceProcessStartKey UInt64 | |
TargetProcessStartKey UInt64 | Kernel-assigned unique key for the target process. |
Event ID 35: task_035
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
FileName UnicodeString | |
OriginalCreationTime Int64 | |
OriginalLastAccessTime Int64 | |
OriginalLastWriteTime Int64 | |
OriginalChangeTime Int64 | |
ModifiedCreationTime Int64 | |
ModifiedLastAccessTime Int64 | |
ModifiedLastWriteTime Int64 | |
ModifiedChangeTime Int64 | |
FileAttributes HexInt32 | |
ProcessStartKey UInt64 |
Event ID 36: task_036
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
AffectedProcessId HexInt32 | |
AffectedProcessTime Int64 | |
AffectedProcessStartKey UInt64 | |
InlineCheck Boolean |
Event ID 37: task_037
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ImageName UnicodeString | |
ImageBase Pointer | |
ImageSize UInt64 | |
DriverName UnicodeString | |
DriverObject Pointer | |
DriverInit Pointer | |
DriverStartIo Pointer | |
DriverUnload Pointer | |
MajorFunctionArraySize UInt32 | |
MajorFunctionArray Binary | |
FastIoDispatchArraySize UInt32 | |
FastIoDispatchArray Binary | |
SuspiciousDispatchBitmap UInt64 | |
ContextInfoArraySize UInt32 | |
ContextInfoArray Binary |
Event ID 38: task_038
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ProcessStartKey UInt64 | |
OldFlags UInt64 | |
NewFlags UInt64 |
Event ID 39: task_039
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
SourceThreadId HexInt32 | |
TargetThreadId HexInt32 | Thread ID in the target process. |
UserSid SID | |
TargetProcessId HexInt32 | Process ID of the target process. |
TargetProcessTime Int64 | |
AccessMask HexInt32 | Access mask reference |
ProcessStartKey UInt64 | |
TargetProcessStartKey UInt64 | Kernel-assigned unique key for the target process. |
Event ID 40: task_040
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
FileName UnicodeString | |
FileAttributes HexInt32 | |
ProcessStartKey UInt64 | |
IsSensitive Boolean | |
RequestSource UInt8 | |
ShareName UnicodeString | |
RemoteIpAddressLength UInt32 | |
RemoteIpAddress Binary |
Event ID 41: task_041
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
Key UnicodeString | |
Value UnicodeString | |
ProcessStartKey UInt64 |
Event ID 42: task_042_V2
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
FileName UnicodeString | |
FileAttributes HexInt32 | |
DesiredAccess HexInt32 | Process access rights reference |
Dispositon HexInt32 | |
ProcessStartKey UInt64 | |
VolumeShadowCopy Boolean | |
FileOpenSource HexInt32 | |
ShareAccess UInt16 | |
RequestSource UInt8 | |
ShareName UnicodeString | |
RemoteIpAddressLength UInt32 | |
RemoteIpAddress Binary |
Event ID 43: task_043_V1
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
FileName UnicodeString | |
NewFileName UnicodeString | |
FileAttributes HexInt32 | |
ProcessStartKey UInt64 | |
RequestSource UInt8 | |
ShareName UnicodeString | |
RemoteIpAddressLength UInt32 | |
RemoteIpAddress Binary |
Event ID 44: task_044
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
Key UnicodeString | |
FileName UnicodeString | |
ProcessStartKey UInt64 |
Event ID 45: task_045
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
Key UnicodeString | |
ProcessStartKey UInt64 | |
SecurityInformation HexInt32 | |
OriginalSecurityDescriptor UnicodeString | |
NewSecurityDescriptor UnicodeString |
Event ID 46: task_046
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
AffectedProcessId HexInt32 | |
AffectedProcessTime Int64 | |
AffectedProcessStartKey UInt64 | |
InlineCheck Boolean | |
OriginalCommandLine UnicodeString | |
ModifiedCommandLine UnicodeString | |
CorruptedCommandLine Boolean |
Event ID 47: task_047
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ProcessStartKey UInt64 | |
IoControlCode HexInt32 | |
DeviceName UnicodeString | |
VolumeName UnicodeString | |
MaximumVolumeSpace UInt64 | |
ApplicationGuid GUID |
Event ID 48: task_048
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ProcessStartKey UInt64 | |
DriverName UnicodeString | |
DriverOriginalName UnicodeString | |
FunctionName UnicodeString | |
IsEnforced Boolean |
Event ID 51: task_051_V1
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ProcessStartKey UInt64 | |
KeyName UnicodeString | |
ValueName UnicodeString | |
RegistryOperations UInt32 | |
OperationBlocked Boolean |
Event ID 52: task_052_V2
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ProcessStartKey UInt64 | |
FileName UnicodeString | |
OperationBlocked Boolean | |
UserSid SID | |
ShareName UnicodeString | |
RemoteIpAddressLength UInt32 | |
RemoteIpAddress Binary | |
Tag UInt32 |
Event ID 53: task_053
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
TimeBeforeAcquiringLock UInt64 | |
TimeAfterAcquiringLock UInt64 | |
TimeBeforeReleasingLock UInt64 | |
StatusOplockAcquiring UInt32 | |
StatusFileOpening UInt32 | |
StatusDuplicateHandle UInt32 | |
FileName UnicodeString | |
Access HexInt32 | |
ShareMode HexInt32 | |
OpenFlags HexInt32 |
Event ID 54: task_054
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
TimeBeforeAcquiringLock UInt64 | |
TimeAfterAcquiringLock UInt64 | |
TimeBeforeReleasingLock UInt64 | |
StatusBeforeRetry UInt32 | |
StatusOfRetry UInt32 | |
StatusAfterRetry UInt32 | |
FileName UnicodeString | |
ProcessId HexInt32 | |
ProcessStartKey UInt64 | |
ProcessCreationTime Int64 | |
IoFunction UInt16 | |
Access HexInt32 | |
ShareMode HexInt32 | |
OpenFlags HexInt32 |
Event ID 55: task_055
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
Key UnicodeString | |
Value UnicodeString | |
ProcessStartKey UInt64 |
Event ID 56: task_056_V2
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ProcessStartKey UInt64 | |
FileName UnicodeString | |
OperationBlocked Boolean | |
UserSid SID | |
ShareName UnicodeString | |
RemoteIpAddressLength UInt32 | |
RemoteIpAddress Binary | |
Tag UInt32 |
Event ID 57: task_057_V2
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ProcessStartKey UInt64 | |
FileName UnicodeString | |
OperationBlocked Boolean | |
UserSid SID | |
ShareName UnicodeString | |
RemoteIpAddressLength UInt32 | |
RemoteIpAddress Binary | |
Tag UInt32 |
Event ID 58: task_058
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
ProcessId HexInt32 | |
ProcessTime Int64 | |
ThreadId HexInt32 | |
UserSid SID | |
SessionId HexInt32 | |
Key UnicodeString | |
ProcessStartKey UInt64 |
Event ID 59: task_059
#Fields #
| Name | Description |
|---|---|
SequenceNumber UInt64 | |
SuspiciousEntryIndex UInt32 | |
TableSize UInt32 | |
Table Binary | |
CodeSize UInt32 | |
Code Binary |
Provenance
ETW provider GUID 16c6501a-ff2d-46ea-868d-8f96cb0cb52d
Defined in mssecflt.sys, the binary that emits these events.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.8821.27906.1000, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.8798.25857.1000, captured 2026-06-02 — Manifest XML pack, 2.0 MB