detection.wiki

Microsoft-Windows-Subsys-SMSS

EventTitleChannelSampleRule
1smss:ExecuteImageStartOperationalNN
2smss:ExecuteImageStopOperationalNN
3smss:InitializeRegistryStartOperationalNN
4smss:InitializeRegistryStopOperationalNN
5smss:SetupExecuteListStartOperationalNN
6smss:SetupExecuteListStopOperationalNN
7smss:BootExecuteListStartOperationalNN
8smss:BootExecuteListStopOperationalNN
9smss:ProcessFileRenamesStartOperationalNN
10smss:ProcessFileRenamesStopOperationalNN
11smss:FileRenameOperationalNN
12The crash dump file could not be created due to a lack of free space on the …SystemNN
13A run level switch from the CurrentRunLevel level to the TargetRunLevel level …SystemNN
14A run level switch from the CurrentRunLevel level to the TargetRunLevel level …SystemNN
15A run level switch from the CurrentRunLevel level to the TargetRunLevel level …SystemNN
16A run level switch from the CurrentRunLevel level to the TargetRunLevel level …SystemNN
17A platform binary was successfully executed.SystemNN
18An attempt to execute a platform binary failed with error code Status.SystemNN
19smss:BootExecuteNoPnpSyncListStartOperationalNN
20smss:BootExecuteNoPnpSyncListStopOperationalNN
21smss:SerializeBootStartOperationalNN
22smss:SerializeBootStopOperationalNN
23smss:LoadSubsystemStartOperationalNN
24smss:LoadSubsystemStopOperationalNN
25smss:InitializeKnownDllsStartOperationalNN
26smss:InitializeKnownDllsStopOperationalNN
27smss:PlatformExecuteListStartOperationalNN
28smss:PlatformExecuteListStopOperationalNN
29smss:SetupExecuteNoPnpSyncListStartOperationalNN
30smss:SetupExecuteNoPnpSyncListStopOperationalNN
31smss:RunSecureKernelTrustletsStartOperationalNN
32smss:RunSecureKernelTrustletsStopOperationalNN

Event ID 1: smss:ExecuteImageStart

#
Channel
Operational
Task
smss:ExecuteImage
Opcode
Start

Fields #

NameDescription
Flags UInt32
ImageNameLength UInt16
ImageName UnicodeString

Event ID 2: smss:ExecuteImageStop

#
Channel
Operational
Task
smss:ExecuteImage
Opcode
Stop

Fields #

NameDescription
ProcessId UInt32

Event ID 3: smss:InitializeRegistryStart

#
Channel
Operational
Task
smss:InitializeRegistry
Opcode
Start

Event ID 4: smss:InitializeRegistryStop

#
Channel
Operational
Task
smss:InitializeRegistry
Opcode
Stop

Event ID 5: smss:SetupExecuteListStart

#
Channel
Operational
Task
smss:SetupExecuteList
Opcode
Start

Event ID 6: smss:SetupExecuteListStop

#
Channel
Operational
Task
smss:SetupExecuteList
Opcode
Stop

Event ID 7: smss:BootExecuteListStart

#
Channel
Operational
Task
smss:BootExecuteList
Opcode
Start

Event ID 8: smss:BootExecuteListStop

#
Channel
Operational
Task
smss:BootExecuteList
Opcode
Stop

Event ID 9: smss:ProcessFileRenamesStart

#
Channel
Operational
Task
smss:ProcessFileRenames
Opcode
Start

Event ID 10: smss:ProcessFileRenamesStop

#
Channel
Operational
Task
smss:ProcessFileRenames
Opcode
Stop

Event ID 11: smss:FileRename

#
Channel
Operational
Task
smss:FileRename

Fields #

NameDescription
FromNameLength UInt16
ToNameLength UInt16
FromName UnicodeString
ToName UnicodeString

Event ID 12: The crash dump file could not be created due to a lack of free space on the destination drive.

#
Channel
System
Opcode
Info

Description

The crash dump file could not be created due to a lack of free space on the destination drive. Increasing the amount of free space on the destination drive may help prevent this error.

Message #

The crash dump file could not be created due to a lack of free space on the destination drive. Increasing the amount of free space on the destination drive may help prevent this error.

Fields #

NameDescription
FileNameLength UInt16
FileName UnicodeString

Event ID 13: A run level switch from the CurrentRunLevel level to the TargetRunLevel level has started.

#
Channel
System
Opcode
Info

Message #

A run level switch from the %1 level to the %2 level has started.

Fields #

NameDescription
CurrentRunLevel UnicodeString
TargetRunLevel UnicodeString

Event ID 14: A run level switch from the CurrentRunLevel level to the TargetRunLevel level has ended successfully.

#
Channel
System
Opcode
Info

Message #

A run level switch from the %1 level to the %2 level has ended successfully.

Fields #

NameDescription
CurrentRunLevel UnicodeString
TargetRunLevel UnicodeString

Event ID 15: A run level switch from the CurrentRunLevel level to the TargetRunLevel level was failed by AgentName with the following error: Error For more details, please refer to events logged ...

#
Channel
System
Opcode
Info

Description

A run level switch from the CurrentRunLevel level to the TargetRunLevel level was failed by.

Message #

A run level switch from the %1 level to the %2 level was failed by 
%3 with the following error: 

%4

For more details, please refer to events logged by this agent.

Fields #

NameDescription
CurrentRunLevel UnicodeString
TargetRunLevel UnicodeString
AgentName UnicodeString
Error UnicodeString

Event ID 16: A run level switch from the CurrentRunLevel level to the TargetRunLevel level was succeeded by AgentName with the following warning: Error For more details, please refer to events lo...

#
Channel
System
Opcode
Info

Description

A run level switch from the CurrentRunLevel level to the TargetRunLevel level was succeeded by.

Message #

A run level switch from the %1 level to the %2 level was succeeded by 
%3 with the following warning: 

%4

For more details, please refer to events logged by this agent.

Fields #

NameDescription
CurrentRunLevel UnicodeString
TargetRunLevel UnicodeString
AgentName UnicodeString
Error UnicodeString

Event ID 17: A platform binary was successfully executed.

#
Channel
System
Opcode
Info

Event ID 18: An attempt to execute a platform binary failed with error code Status.

#
Channel
System
Opcode
Info

Message #

An attempt to execute a platform binary failed with error code %1.

Fields #

NameDescription
Status UInt32NTSTATUS reference

Event ID 19: smss:BootExecuteNoPnpSyncListStart

#
Channel
Operational
Task
smss:BootExecuteNoPnpSyncList
Opcode
Start

Event ID 20: smss:BootExecuteNoPnpSyncListStop

#
Channel
Operational
Task
smss:BootExecuteNoPnpSyncList
Opcode
Stop

Event ID 21: smss:SerializeBootStart

#
Channel
Operational
Task
smss:SerializeBoot
Opcode
Start

Event ID 22: smss:SerializeBootStop

#
Channel
Operational
Task
smss:SerializeBoot
Opcode
Stop

Fields #

NameDescription
Status UInt32NTSTATUS reference

Event ID 23: smss:LoadSubsystemStart

#
Channel
Operational
Task
smss:LoadSubsystem
Opcode
Start

Fields #

NameDescription
SessionId UInt32
ImageNameLength UInt16
ImageName UnicodeString

Event ID 24: smss:LoadSubsystemStop

#
Channel
Operational
Task
smss:LoadSubsystem
Opcode
Stop

Fields #

NameDescription
Status UInt32NTSTATUS reference

Event ID 25: smss:InitializeKnownDllsStart

#
Channel
Operational
Task
smss:InitializeKnownDlls
Opcode
Start

Event ID 26: smss:InitializeKnownDllsStop

#
Channel
Operational
Task
smss:InitializeKnownDlls
Opcode
Stop

Fields #

NameDescription
Status UInt32NTSTATUS reference

Event ID 27: smss:PlatformExecuteListStart

#
Channel
Operational
Task
smss:PlatformExecuteList
Opcode
Start

Event ID 28: smss:PlatformExecuteListStop

#
Channel
Operational
Task
smss:PlatformExecuteList
Opcode
Stop

Event ID 29: smss:SetupExecuteNoPnpSyncListStart

#
Channel
Operational
Task
smss:SetupExecuteNoPnpSyncList
Opcode
Start

Event ID 30: smss:SetupExecuteNoPnpSyncListStop

#
Channel
Operational
Task
smss:SetupExecuteNoPnpSyncList
Opcode
Stop

Event ID 31: smss:RunSecureKernelTrustletsStart

#
Channel
Operational
Task
smss:RunSecureKernelTrustlets
Opcode
Start

Event ID 32: smss:RunSecureKernelTrustletsStop

#
Channel
Operational
Task
smss:RunSecureKernelTrustlets
Opcode
Stop

Provenance

ETW provider GUID 43e63da5-41d1-4fbf-aded-1bbed98fdd1d

Defined in csrsrv.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB