detection.wiki

Microsoft-Windows-TimeBroker

EventTitleChannelSampleRule
1Event ID BrokeredEventId changed state from OldState to NewState.TimeBrokerNN
2Event ID BrokeredEventId is set to fire between StartTime and EndTime.TimeBrokerNN
3TimeBroker CreateEvent called for Event ID BrokeredEventId with Event Type …TimeBrokerNN
4TimeBroker DeleteEvent called for Event ID BrokeredEventId and returned Status.TimeBrokerNN

Event ID 1: Event ID BrokeredEventId changed state from OldState to NewState.

#
Channel
TimeBroker

Message #

Event ID %1 changed state from %2 to %3

Fields #

NameDescription
BrokeredEventId GUID
OldState UInt32
NewState UInt32

Event ID 2: Event ID BrokeredEventId is set to fire between StartTime and EndTime.

#
Channel
TimeBroker

Message #

Event ID %1 is set to fire between %2 and %3

Fields #

NameDescription
BrokeredEventId GUID
StartTime FILETIME
EndTime FILETIME

Event ID 3: TimeBroker CreateEvent called for Event ID BrokeredEventId with Event Type EventType returned Status.

#
Channel
TimeBroker

Message #

TimeBroker CreateEvent called for Event ID %1 with Event Type %2 returned %3

Fields #

NameDescription
BrokeredEventId GUID
EventType UInt32
Status HexInt32NTSTATUS reference

Event ID 4: TimeBroker DeleteEvent called for Event ID BrokeredEventId and returned Status.

#
Channel
TimeBroker

Message #

TimeBroker DeleteEvent called for Event ID %1 and returned %2

Fields #

NameDescription
BrokeredEventId GUID
Status HexInt32NTSTATUS reference

Provenance

ETW provider GUID 0657adc1-9ae8-4e18-932d-e6079cda5ab3

Defined in TimeBrokerServer.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB