Microsoft-Windows-WinML
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | Name | Analytic | N | N |
| 2 | Name | Analytic | N | N |
| 3 | Name | Analytic | N | N |
| 4 | Name | Analytic | N | N |
| 5 | Name | Analytic | N | N |
| 6 | Name | Analytic | N | N |
| 7 | Name | Analytic | N | N |
Event ID 1: Name
#Event ID 2: Name
#Event ID 4: Name
#Event ID 5: Name
#Fields #
| Name | Description |
|---|---|
pNet Pointer | |
WinMLOpNameSize UInt32 | |
WinMLOpName AnsiString | |
WinMLOpSectionNameSize UInt32 | |
WinMLOpSectionName AnsiString |
Event ID 6: Name
#Provenance
ETW provider GUID c8517e09-bea2-5bb6-bef3-50b4c91c431e
Defined in WinML.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1150, captured 2026-06-02 — Manifest XML pack, 2.0 MB