Microsoft-Windows-URLMon

Event	Title	Channel	Sample	Rule
801	URLMON_Queue_Msg	Analytic	N	N
802	URLMON_Process_Queued_Msg	Analytic	N	N
803	URLMON_CINet_Read	Analytic	N	N
804	URLMON_CINet_Read804	Analytic	N	N
805	URLMON_CInet_Start	Analytic	N	N
806	URLMON_CINet_Abort	Analytic	N	N
807	URLMON_CINet_Binding	Analytic	N	N
808	URLMON_CINet_Write	Analytic	N	N

Event ID 801: URLMON_Queue_Msg

Channel: Analytic
Task: URLMON_Queue_Msg

Fields #

Name	Description
`Msg` UInt32
`URL` UnicodeString

Event ID 802: URLMON_Process_Queued_Msg

Channel: Analytic
Task: URLMON_Process_Queued_Msg

Fields #

Name	Description
`Msg` UInt32
`URL` UnicodeString

Event ID 803: URLMON_CINet_Read

Channel: Analytic
Task: URLMON_CINet_Read

Fields #

Name	Description
`Msg` UInt32
`URL` UnicodeString
`Bytes` UInt32

Event ID 804: URLMON_CINet_Read804

Channel: Analytic
Task: URLMON_CINet_Read

Fields #

Name	Description
`Bytes` UInt32
`URL` UnicodeString

Event ID 805: URLMON_CInet_Start

Channel: Analytic
Task: URLMON_CInet_Start

Fields #

Name	Description
`Flags` UInt32
`URL` UnicodeString

Event ID 806: URLMON_CINet_Abort

Channel: Analytic
Task: URLMON_CINet_Abort

Fields #

Name	Description
`Reason` UInt32
`URL` UnicodeString

Event ID 807: URLMON_CINet_Binding

Channel: Analytic
Task: URLMON_CINet_Binding

Fields #

Name	Description
`CInet` Pointer
`Binding` Pointer

Event ID 808: URLMON_CINet_Write

Channel: Analytic
Task: URLMON_CINet_Write

Fields #

Name	Description
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`Bytes` UInt32
`URL` UnicodeString
`CInet` Pointer

Provenance

ETW provider GUID 245f975d-909d-49ed-b8f9-9a75691d6b6b

Defined in urlmon.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 11.00.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 11.00.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB