Microsoft-Windows-WCNWiz
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 8001 | ComboKeyPageStop | Analytic | N | N |
| 8002 | ComboKeyPageStart | Analytic | N | N |
| 8003 | PINPageStart | Analytic | N | N |
| 8004 | PINPageStop | Analytic | N | N |
| 8007 | ConnectNoProfileStop | Analytic | N | N |
Event ID 8001: ComboKeyPageStop
#Event ID 8002: ComboKeyPageStart
#Event ID 8003: PINPageStart
#Event ID 8004: PINPageStop
#Event ID 8007: ConnectNoProfileStop
#Provenance
ETW provider GUID e8aa5402-26a1-455e-a21b-f240ed62d155
Defined in wcnwiz.dll, which carries the event manifest.
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB