detection.wiki

Microsoft-Windows-VWiFi

EventTitleChannelSampleRule
25001Received request to enable virtualization.DiagnosticNN
25002Received request to disable virtualization.DiagnosticNN
25003Virtual Miniport Started.DiagnosticNN
25004Virtual Miniport Stopped.DiagnosticNN

Event ID 25001: Received request to enable virtualization.

#
Channel
Diagnostic
Task
EnableVWiFi
Opcode
Start

Message #

Received request to enable virtualization. 

	Network Adapter: %2
	Interface GUID: %1

Fields #

NameDescription
IfGuid GUID
FriendlyName UnicodeString

Event ID 25002: Received request to disable virtualization.

#
Channel
Diagnostic
Task
DisableVWiFi
Opcode
Start

Message #

Received request to disable virtualization. 

	Network Adapter: %2
	Interface GUID: %1

Fields #

NameDescription
IfGuid GUID
FriendlyName UnicodeString

Event ID 25003: Virtual Miniport Started.

#
Channel
Diagnostic
Task
EnableVWiFi
Opcode
Stop

Message #

Virtual Miniport Started. 

	Network Adapter: %2
	Interface GUID: %1 Virtual Interface GUID: %3

Fields #

NameDescription
IfGuid GUID
FriendlyName UnicodeString
VIfGuid GUID

Event ID 25004: Virtual Miniport Stopped.

#
Channel
Diagnostic
Task
DisableVWiFi
Opcode
Stop

Message #

Virtual Miniport Stopped. 

	Network Adapter: %2
	Interface GUID: %1 Virtual Interface GUID: %3

Fields #

NameDescription
IfGuid GUID
FriendlyName UnicodeString
VIfGuid GUID

Provenance

ETW provider GUID 314b2b0d-81ee-4474-b6e0-c2aaec0ddbde

Defined in vwififlt.sys, the binary that emits these events.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4484, captured 2026-06-02 — Manifest XML pack, 2.0 MB