detection.wiki

Microsoft-Windows-Tethering-Station

EventTitleChannelSampleRule
1001task_0StartAnalyticNN
1002task_0StopAnalyticNN
1003task_0Stop1003AnalyticNN

Event ID 1001: task_0Start

#
Channel
Analytic
Opcode
Start

Fields #

NameDescription
WlanInterfaceGuid GUID

Event ID 1002: task_0Stop

#
Channel
Analytic
Opcode
Stop

Fields #

NameDescription
WlanInterfaceGuid GUID
Scenario UInt32
Result UInt32

Event ID 1003: task_0Stop1003

#
Channel
Analytic
Opcode
Stop

Fields #

NameDescription
WlanInterfaceGuid GUID

Provenance

ETW provider GUID 585cab4f-9351-436e-9d99-dc4b41a20de0

Defined in TetheringStation.dll, which carries the event manifest.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB