Microsoft-Windows-Shell-Shwebsvc
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | StartupStart | Microsoft-Windows-Shell-Shwebsvc | N | N |
| 2 | StartupStop | Microsoft-Windows-Shell-Shwebsvc | N | N |
| 3 | AddPagesStart | Microsoft-Windows-Shell-Shwebsvc | N | N |
| 4 | AddPagesStop | Microsoft-Windows-Shell-Shwebsvc | N | N |
| 5 | BuildManifestStart | Microsoft-Windows-Shell-Shwebsvc | N | N |
| 6 | BuildManifestStop | Microsoft-Windows-Shell-Shwebsvc | N | N |
| 7 | InitServicesStart | Microsoft-Windows-Shell-Shwebsvc | N | N |
| 8 | InitServicesStop | Microsoft-Windows-Shell-Shwebsvc | N | N |
| 9 | CancelStart | Microsoft-Windows-Shell-Shwebsvc | N | N |
| 10 | CancelStop | Microsoft-Windows-Shell-Shwebsvc | N | N |
| 11 | NextStart | Microsoft-Windows-Shell-Shwebsvc | N | N |
| 12 | NextStop | Microsoft-Windows-Shell-Shwebsvc | N | N |
| 13 | BackStart | Microsoft-Windows-Shell-Shwebsvc | N | N |
| 14 | BackStop | Microsoft-Windows-Shell-Shwebsvc | N | N |
| 15 | UploadStart | Microsoft-Windows-Shell-Shwebsvc | N | N |
| 16 | UploadStop | Microsoft-Windows-Shell-Shwebsvc | N | N |
Event ID 1: StartupStart
#Event ID 2: StartupStop
#Event ID 3: AddPagesStart
#Event ID 4: AddPagesStop
#Event ID 5: BuildManifestStart
#Event ID 6: BuildManifestStop
#Event ID 7: InitServicesStart
#Event ID 8: InitServicesStop
#Event ID 9: CancelStart
#Event ID 10: CancelStop
#Event ID 11: NextStart
#Event ID 12: NextStop
#Event ID 13: BackStart
#Event ID 14: BackStop
#Event ID 15: UploadStart
#Event ID 16: UploadStop
#Provenance
ETW provider GUID f61cefc0-aa2e-11da-a746-0800200c9a66
Defined in shwebsvc.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB