detection.wiki

Microsoft-Windows-Websocket-Protocol-Component

EventTitleChannelSampleRule
1TraceMessage.TracingNN
2Operation of 'OperationType' type queued with ID 'Id'.TracingNN
3Operation 'Id' is executing action 'ActionType'.TracingNN
4Operation 'Id' finished.TracingNN

Event ID 1: TraceMessage.

#
Channel
Tracing
Task
Parser

Message #

%1

Fields #

NameDescription
TraceMessage UnicodeString
Error HexInt32

Event ID 2: Operation of 'OperationType' type queued with ID 'Id'.

#
Channel
Tracing
Task
Actionqueue
Opcode
Start

Message #

Operation of '%2' type queued with ID '%1'.

Fields #

NameDescription
Id UInt32
OperationType UInt32
Known values
%%1904
New registry value created
%%1905
Existing registry value modified
%%1906
Registry value deleted
%%14674
Value Added
%%14675
Value Deleted
%%14680
Value Added With Expiration Time
%%14681
Value Deleted With Expiration Time
%%14688
Value Auto Deleted With Expiration Time

Event ID 3: Operation 'Id' is executing action 'ActionType'.

#
Channel
Tracing
Task
Actionqueue

Message #

Operation '%1' is executing action '%2'.

Fields #

NameDescription
Id UInt32
ActionType UInt32

Event ID 4: Operation 'Id' finished.

#
Channel
Tracing
Task
Actionqueue
Opcode
Stop

Message #

Operation '%1' finished.

Fields #

NameDescription
Id UInt32

Provenance

ETW provider GUID cba5f63c-e2cf-4b36-8305-bde1311924fc

Defined in websocket.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB