detection.wiki

Microsoft-Windows-SetupPlatform

EventTitleChannelSampleRule
1001Start operation: Start_operation, Operation.AnalyticNN
1002Stop operation: Stop_operation, Operation.AnalyticNN
1003Online gather starts: Online_gather_starts, OfflineWinDir.AnalyticNN
1004Online gather stops: Online_gather_stops, OfflineWinDir.AnalyticNN
1005Offline gather startsAnalyticNN
1006Offline gather stopsAnalyticNN
2005New Setup informationSystemYN

Event ID 1001: Start operation: Start_operation, Operation.

#
Channel
Analytic
Task
Runoperation
Opcode
Start

Message #

Start operation: %1, %2

Fields #

NameDescription
Operation UnicodeString
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
ErrorCode UInt32

Event ID 1002: Stop operation: Stop_operation, Operation.

#
Channel
Analytic
Task
Runoperation
Opcode
Stop

Message #

Stop operation: %1, %2

Fields #

NameDescription
Operation UnicodeString
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
ErrorCode UInt32

Event ID 1003: Online gather starts: Online_gather_starts, OfflineWinDir.

#
Channel
Analytic
Task
Onlinegather
Opcode
Start

Message #

Online gather starts: %1, %2

Fields #

NameDescription
OfflineWinDir UnicodeString
MachineSpecific UInt32

Event ID 1004: Online gather stops: Online_gather_stops, OfflineWinDir.

#
Channel
Analytic
Task
Onlinegather
Opcode
Stop

Message #

Online gather stops: %1, %2

Fields #

NameDescription
OfflineWinDir UnicodeString
MachineSpecific UInt32

Event ID 1005: Offline gather starts

#
Channel
Analytic
Task
Offlinegather
Opcode
Start

Event ID 1006: Offline gather stops

#
Channel
Analytic
Task
Offlinegather
Opcode
Stop

Event ID 2005: New Setup information

#
Channel
System
Level
Informational
Task
InstallWindowsTask

Fields #

NameDescription
Installationchoice UInt32
HostOSMajorversion UInt32
HostOSMinorversion UInt32
HostOSBuildnumber UInt32
HostOSServicepackmajornumber UInt32
HostOSServicepackminornumber UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SetupPlatform",
    "guid": "{530fb9b9-c515-4472-9313-fb346f9255e3}",
    "event_source_name": "",
    "event_id": 2005,
    "version": 0,
    "level": 4,
    "task": 1003,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2026-04-18 00:24:33.072126+00:00",
    "event_record_id": 49,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 1408,
      "thread_id": 1412
    },
    "channel": "System",
    "computer": "USERUSE-I0E7KUG",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Installation choice": "1",
    "Host OS Major version": "10",
    "Host OS Minor version": "0",
    "Host OS Build number": "26100",
    "Host OS Service pack major number": "0",
    "Host OS Service pack minor number": "0"
  },
  "message": "New Setup information"
}

Example keys not documented in the fields table: Host OS Build number, Host OS Major version, Host OS Minor version, Host OS Service pack major number, Host OS Service pack minor number, Installation choice

Provenance

ETW provider GUID 530fb9b9-c515-4472-9313-fb346f9255e3

Defined in setupetw.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4202, captured 2026-06-02 — Manifest XML pack, 2.0 MB