Microsoft-Windows-User-Loader

12 events across 2 channels

Event	Title	Channel	Sample
1	Deprecated module FileName.	Analytic	N
2	Process ProcessFileNamePath encountered a fatal user callback exception.	Analytic	N
3	Error status code FailureReason returned when ProcessImagePath attempted to load …	Analytic	N
4	The process launches a 16 bit process.	Analytic	N
5	Windows component on demand ProcessId.	Analytic	N
6	The Loader encountered a fatal error while loading a thread from process image …	Analytic	N
7	A fatal error occured during initalization of FileName.	Analytic	N
8	Error status code FailureReason returned when ExportModule attempted to load …	Analytic	N
9	The Loader encountered a fatal error running process image name FileName.	Analytic	N
10	Error status code FailureReason returned when ProcessImagePath attempted to load …	Application	N
11	Loading dependency CurDirDllPath from the current directory was not allowed when …	Application	N
12	Loading dependency CurDirDllPath from the current directory was not allowed when …	Application	N

Event ID 1: Deprecated module FileName.

Provider: Microsoft-Windows-User-Loader
Channel: Analytic
Opcode: Info

Description

Deprecated module FileName.

Message #

Deprecated module %1.

Fields #

Name	Description
`FileName` UnicodeString

Event ID 2: Process ProcessFileNamePath encountered a fatal user callback exception.

Provider: Microsoft-Windows-User-Loader
Channel: Analytic
Opcode: Info

Description

Process ProcessFileNamePath encountered a fatal user callback exception.

Message #

Process %2 encountered a fatal user callback exception.

Fields #

Name	Description
`ProcessFileNamePathLength` UInt16
`ProcessFileNamePath` UnicodeString

Event ID 3: Error status code FailureReason returned when ProcessImagePath attempted to load dependency ImportDllName.

Provider: Microsoft-Windows-User-Loader
Channel: Analytic
Opcode: Info

Description

Error status code FailureReason returned when ProcessImagePath attempted to load dependency ImportDllName.

Message #

Error status code %1 returned when %3 attempted to load dependency %2.

Fields #

Name	Description
`FailureReason` UInt32	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.
`ImportDllName` UnicodeString
`ProcessImagePath` UnicodeString

Event ID 4: The process launches a 16 bit process.

Provider: Microsoft-Windows-User-Loader
Channel: Analytic
Opcode: Info

Description

The process launches a 16 bit process.

Message #

The process launches a 16 bit process.

Fields #

Name	Description
`FileName` UnicodeString

Event ID 5: Windows component on demand ProcessId.

Provider: Microsoft-Windows-User-Loader
Channel: Analytic
Opcode: Info

Description

Windows component on demand ProcessId.

Message #

Windows component on demand %1.

Fields #

Name	Description
`ProcessId` UInt32
`SuspendProcessRequest` UInt32
`DLLName` UnicodeString

Event ID 6: The Loader encountered a fatal error while loading a thread from process image name FileName.

Provider: Microsoft-Windows-User-Loader
Channel: Analytic
Opcode: Info

Description

The Loader encountered a fatal error while loading a thread from process image name FileName.

Message #

The Loader encountered a fatal error while loading a thread from process image name %1.

Fields #

Name	Description
`FileName` UnicodeString

Event ID 7: A fatal error occured during initalization of FileName.

Provider: Microsoft-Windows-User-Loader
Channel: Analytic
Opcode: Info

Description

A fatal error occured during initalization of FileName.

Message #

A fatal error occured during initalization of %1.

Fields #

Name	Description
`FileName` UnicodeString

Event ID 8: Error status code FailureReason returned when ExportModule attempted to load dependency ImportDllName.

Provider: Microsoft-Windows-User-Loader
Channel: Analytic
Opcode: Info

Description

Error status code FailureReason returned when ExportModule attempted to load dependency ImportDllName.

Message #

Error status code %1 returned when %3 attempted to load dependency %2.

Fields #

Name	Description
`FailureReason` UInt32	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.
`ImportDllName` UnicodeString
`ExportModule` UnicodeString

Event ID 9: The Loader encountered a fatal error running process image name FileName.

Provider: Microsoft-Windows-User-Loader
Channel: Analytic
Opcode: Info

Description

The Loader encountered a fatal error running process image name FileName.

Message #

The Loader encountered a fatal error running process image name %1.

Fields #

Name	Description
`FileName` UnicodeString

Event ID 10: Error status code FailureReason returned when ProcessImagePath attempted to load dependency ImportDllName.

Provider: Microsoft-Windows-User-Loader
Channel: Application
Opcode: Info

Description

Error status code FailureReason returned when ProcessImagePath attempted to load dependency ImportDllName.

Message #

Error status code %1 returned when %3 attempted to load dependency %2.

Fields #

Name	Description
`FailureReason` UInt32	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.
`ImportDllName` UnicodeString
`ProcessImagePath` UnicodeString

Event ID 11: Loading dependency CurDirDllPath from the current directory was not allowed when attempted by ProcessImagePath.

Provider: Microsoft-Windows-User-Loader
Channel: Application
Opcode: Info

Description

Loading dependency CurDirDllPath from the current directory was not allowed when attempted by ProcessImagePath. Another DLL was found: FoundDllPath. For more information, see http://go.microsoft.com/fwlink/?LinkId=718136.

Message #

Loading dependency %2 from the current directory was not allowed when attempted by %1. Another DLL was found: %3. For more information, see http://go.microsoft.com/fwlink/?LinkId=718136.

Fields #

Name	Description
`ProcessImagePath` UnicodeString
`CurDirDllPath` UnicodeString
`FoundDllPath` UnicodeString

Event ID 12: Loading dependency CurDirDllPath from the current directory was not allowed when attempted by ProcessImagePath.

Provider: Microsoft-Windows-User-Loader
Channel: Application
Opcode: Info

Description

Loading dependency CurDirDllPath from the current directory was not allowed when attempted by ProcessImagePath. No other DLL was found and the dependency resolution failed. For more information, see http://go.microsoft.com/fwlink/?LinkId=718136.

Message #

Loading dependency %2 from the current directory was not allowed when attempted by %1. No other DLL was found and the dependency resolution failed. For more information, see http://go.microsoft.com/fwlink/?LinkId=718136.

Fields #

Name	Description
`ProcessImagePath` UnicodeString
`CurDirDllPath` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID b059b83f-d946-4b13-87ca-4292839dc2f2

Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-User-Loader

Event ID 1: Deprecated module FileName.

Description

Message #

Fields #

Event ID 2: Process ProcessFileNamePath encountered a fatal user callback exception.

Description

Message #

Fields #

Event ID 3: Error status code FailureReason returned when ProcessImagePath attempted to load dependency ImportDllName.

Description

Message #

Fields #

Event ID 4: The process launches a 16 bit process.

Description

Message #

Fields #

Event ID 5: Windows component on demand ProcessId.

Description

Message #

Fields #

Event ID 6: The Loader encountered a fatal error while loading a thread from process image name FileName.

Description

Message #

Fields #

Event ID 7: A fatal error occured during initalization of FileName.

Description

Message #

Fields #

Event ID 8: Error status code FailureReason returned when ExportModule attempted to load dependency ImportDllName.

Description

Message #

Fields #

Event ID 9: The Loader encountered a fatal error running process image name FileName.

Description

Message #

Fields #

Event ID 10: Error status code FailureReason returned when ProcessImagePath attempted to load dependency ImportDllName.

Description

Message #

Fields #

Event ID 11: Loading dependency CurDirDllPath from the current directory was not allowed when attempted by ProcessImagePath.

Description

Message #

Fields #

Event ID 12: Loading dependency CurDirDllPath from the current directory was not allowed when attempted by ProcessImagePath.

Description

Message #

Fields #

Provenance

Downloads