detection.wiki

Microsoft-Windows-Sudo

EventTitleChannelSampleRule
1FullCommandline.AdminNN
2FullCommandline.AdminNN

Event ID 1: FullCommandline.

#
Channel
Admin

Message #

%8

Fields #

NameDescription
Application AnsiString
ArgsCount UInt32
Argument AnsiString
CurrentWorkingDirectory AnsiString
Mode UInt32
InheritEnvironment UInt8
Redirected UInt8
FullCommandline AnsiString
RequestID GUID

Event ID 2: FullCommandline.

#
Channel
Admin

Message #

%8

Fields #

NameDescription
Application AnsiString
ArgsCount UInt32
Argument AnsiString
CurrentWorkingDirectory AnsiString
Mode UInt32
InheritEnvironment UInt8
Redirected UInt8
FullCommandline AnsiString
RequestID GUID

Provenance

ETW provider GUID 9d74dc62-b75f-54cd-be9e-c28940b5feed

Defined in sudo.exe, which carries the event manifest.

  • Win11-26200.6584, schema read from the registered manifest, binary version 1.0.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB