detection.wiki

Microsoft-Windows-TriggerEmulatorProvider

EventTitleChannelSampleRule
1task_0Opcode_TriggerEmulatorEventOperationalNN

Event ID 1: task_0Opcode_TriggerEmulatorEvent

#
Channel
Operational
Opcode
Opcode_TriggerEmulatorEvent

Fields #

NameDescription
ConsumerName UnicodeString
NamedValues UnicodeString

Provenance

ETW provider GUID f230d19a-5d93-47d9-a83f-53829edfb8df

Defined in schedsvc.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB