detection.wiki

Microsoft-Windows-SystemEventsBroker

EventTitleChannelSampleRule
15SystemEventsBroker CreateEvent called for Event ID BrokeredEventId, UserSID: …SystemEventsBrokerNN
16SystemEventsBroker DeleteEvent called for Event ID BrokeredEventId.SystemEventsBrokerNN
17SystemEventsBroker SignalEvent for Event ID BrokeredEventId.SystemEventsBrokerNN
18SystemEventsBroker DropEvent for Event ID BrokeredEventId.SystemEventsBrokerNN
19SystemEventsBroker SessionConnectedEvent, SessionID: SessionID.SystemEventsBrokerNN

Event ID 15: SystemEventsBroker CreateEvent called for Event ID BrokeredEventId, UserSID: UserSID with Event Type EventType.

#
Channel
SystemEventsBroker
Task
SebEvent
Opcode
Create

Message #

SystemEventsBroker CreateEvent called for Event ID %1, UserSID: %2 with Event Type %3

Fields #

NameDescription
BrokeredEventId GUID
UserSID SID
EventType UInt32

Event ID 16: SystemEventsBroker DeleteEvent called for Event ID BrokeredEventId.

#
Channel
SystemEventsBroker
Task
SebEvent
Opcode
Delete

Message #

SystemEventsBroker DeleteEvent called for Event ID %1

Fields #

NameDescription
BrokeredEventId GUID

Event ID 17: SystemEventsBroker SignalEvent for Event ID BrokeredEventId.

#
Channel
SystemEventsBroker
Task
SebEvent
Opcode
Signal

Message #

SystemEventsBroker SignalEvent for Event ID %1

Fields #

NameDescription
BrokeredEventId GUID

Event ID 18: SystemEventsBroker DropEvent for Event ID BrokeredEventId.

#
Channel
SystemEventsBroker
Task
SebEvent
Opcode
Drop

Message #

SystemEventsBroker DropEvent for Event ID %1

Fields #

NameDescription
BrokeredEventId GUID

Event ID 19: SystemEventsBroker SessionConnectedEvent, SessionID: SessionID.

#
Channel
SystemEventsBroker
Task
SebEvent
Opcode
SessionConnected

Message #

SystemEventsBroker SessionConnectedEvent, SessionID: %1

Fields #

NameDescription
SessionID UInt32

Provenance

ETW provider GUID b6bfcc79-a3af-4089-8d4d-0eecb1b80779

Defined in SystemEventsBrokerServer.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB