detection.wiki

Microsoft-Windows-WinMDE

EventTitleChannelSampleRule
1HttpListener@Object object created.MDENN
2HttpListener@Object object destroyed.MDENN
3HttpListener@Object HTTP request received.MDENN
4HttpListener@Object sending HTTP response entity body (Value chunks).MDENN
5NetStreamSink_SampleRequests @Object Value requests.MDENN
6RtspSink_SetWorkQueue @Object StreamIndex requests.MDENN
7RtspSink_ProcessSample_Start @Object.MDENN
8RtspSink_ProcessSample_Stop @Object.MDENN

Event ID 1: HttpListener@Object object created.

#
Channel
MDE
Task
HTTPListener
Opcode
Start

Message #

HttpListener@%1 object created

Fields #

NameDescription
Object Pointer

Event ID 2: HttpListener@Object object destroyed.

#
Channel
MDE
Task
HTTPListener
Opcode
Stop

Message #

HttpListener@%1 object destroyed

Fields #

NameDescription
Object Pointer

Event ID 3: HttpListener@Object HTTP request received.

#
Channel
MDE
Task
HTTPListener

Message #

HttpListener@%1 HTTP request received

Fields #

NameDescription
Object Pointer

Event ID 4: HttpListener@Object sending HTTP response entity body (Value chunks).

#
Channel
MDE
Task
HTTPListener

Message #

HttpListener@%1 sending HTTP response entity body (%2 chunks)

Fields #

NameDescription
Object Pointer
Value UInt32

Event ID 5: NetStreamSink_SampleRequests @Object Value requests.

#
Channel
MDE
Task
NetStreamSink_SampleRequests

Message #

NetStreamSink_SampleRequests @%1 %2 requests

Fields #

NameDescription
Object Pointer
Value UInt32

Event ID 6: RtspSink_SetWorkQueue @Object StreamIndex requests.

#
Channel
MDE
Task
RtspSink_SetWorkQueueTask

Message #

RtspSink_SetWorkQueue @%1 %2 requests

Fields #

NameDescription
Object Pointer
StreamIndex UInt32
WorkQueueID UInt32

Event ID 7: RtspSink_ProcessSample_Start @Object.

#
Channel
MDE
Task
RtspSink_ProcessSampleTask
Opcode
Start

Message #

RtspSink_ProcessSample_Start @%1

Fields #

NameDescription
Object Pointer

Event ID 8: RtspSink_ProcessSample_Stop @Object.

#
Channel
MDE
Task
RtspSink_ProcessSampleTask
Opcode
Stop

Message #

RtspSink_ProcessSample_Stop @%1

Fields #

NameDescription
Object Pointer

Provenance

ETW provider GUID 77549803-7bb1-418b-a98e-f2e22f35a873

Defined in winmde.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB