detection.wiki

Microsoft-Windows-System-Profile-HardwareId

EventTitleChannelSampleRule
1001SystemProfile.Task.GetPackageSpecificTokenStartDiagnosticNN
1002SystemProfile.Task.GetPackageSpecificTokenStopDiagnosticNN

Event ID 1001: SystemProfile.Task.GetPackageSpecificTokenStart

#
Channel
Diagnostic
Task
SystemProfile.Task.GetPackageSpecificToken
Opcode
Start

Event ID 1002: SystemProfile.Task.GetPackageSpecificTokenStop

#
Channel
Diagnostic
Task
SystemProfile.Task.GetPackageSpecificToken
Opcode
Stop

Provenance

ETW provider GUID 3419de6d-5d7f-4668-acc8-f80566814d96

Defined in Windows.System.Profile.HardwareId.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB