Microsoft-Windows-Winsock-Sockets

Event	Title	Channel	Sample	Rule
1	SockCreateStart	Operational	Y	N
2	SockCreateStop	Operational	Y	N
3	SockClose	Operational	Y	N
4	SockClose	Operational	Y	N
5	SockAcceptStart	Operational	N	N
6	SockAcceptStop	Operational	N	N
7	SockSetOptStart	Operational	Y	N
8	SockSetOptStop	Operational	Y	N
9	SockConnectStart	Operational	Y	N
10	SockConnectStop	Operational	Y	N
11	SockBindStart	Operational	Y	N
12	SockBindStop	Operational	Y	N
13	SockGetOptStart	Operational	Y	N
14	SockGetOptStop	Operational	Y	N
15	SockListenStart	Operational	N	N
16	SockListenStop	Operational	N	N

Event ID 1: SockCreateStart

Channel: Operational
Level: Verbose
Task: SockCreate
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Winsock-Sockets/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1600,
      "thread_id": 2332
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Winsock-Sockets",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:34:28.262Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2: SockCreateStop

Channel: Operational
Level: Informational
Task: SockCreate
Opcode: Stop

Fields #

Name	Description
`ErrorCode` HexInt32
`Socket` Pointer
`AddressFamily` UInt32
`SocketType` UInt32
`Protocol` UInt32	Known values `0` HOPOPT `1` ICMP `2` IGMP `6` TCP `17` UDP `41` IPv6 `43` IPv6-Route `44` IPv6-Frag `47` GRE `50` ESP `51` AH `58` ICMPv6 `89` OSPF `103` PIM `132` SCTP
`ProcessId` UInt32
`FailurePoint` HexInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Winsock-Sockets/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1600,
      "thread_id": 2332
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Winsock-Sockets",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:34:28.262Z",
    "version": 0
  },
  "event_data": {
    "AddressFamily": 23,
    "ErrorCode": "00000000",
    "FailurePoint": "00000000",
    "ProcessId": 1600,
    "Protocol": 6,
    "Socket": "0x8BC",
    "SocketType": 1
  },
  "message": ""
}

Event ID 3: SockClose

Channel: Operational
Level: Verbose
Task: SockClose
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winsock-Sockets",
    "guid": "{BDE46AEA-2357-51FE-7367-D5296F530BD1}",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 5,
    "task": 1001,
    "opcode": 1,
    "keywords": "0x0000000000001001",
    "time_created": "2026-06-02T04:01:52.944+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{EB64A0B3-7FFC-0000-D588-CD01FC2D780D}"
    },
    "execution": {
      "process_id": 11772,
      "thread_id": 13132
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SockClose"
}

Event ID 4: SockClose

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: SockClose
Opcode: Stop

Fields #

Name	Description
`ErrorCode` HexInt32
`Socket` Pointer
`IsProviderSocket` Boolean
`FailurePoint` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winsock-Sockets",
    "guid": "{BDE46AEA-2357-51FE-7367-D5296F530BD1}",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 4,
    "task": 1001,
    "opcode": 2,
    "keywords": "0x0000000000001001",
    "time_created": "2026-06-02T04:01:52.944+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{EB64A0B3-7FFC-0000-D588-CD01FC2D780D}"
    },
    "execution": {
      "process_id": 11772,
      "thread_id": 13132
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ErrorCode": "00000000",
    "FailurePoint": "00000000",
    "IsProviderSocket": true,
    "Socket": "0x6DC"
  },
  "message": "SockClose"
}

Event ID 5: SockAcceptStart

Channel: Operational
Task: SockAccept
Opcode: Start

Event ID 6: SockAcceptStop

Channel: Operational
Task: SockAccept
Opcode: Stop

Fields #

Name	Description
`ErrorCode` HexInt32
`SocketAccepted` Pointer
`SocketListening` Pointer
`ProcessId` UInt32
`FailurePoint` HexInt32

Event ID 7: SockSetOptStart

Channel: Operational
Level: Verbose
Task: SockSetOpt
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Winsock-Sockets/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 7,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1600,
      "thread_id": 2332
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Winsock-Sockets",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:34:28.262Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 8: SockSetOptStop

Channel: Operational
Level: Informational
Task: SockSetOpt
Opcode: Stop

Fields #

Name	Description
`ErrorCode` HexInt32
`Socket` Pointer
`Level` Int32
`OptName` Int32
`OptLen` UInt32
`OptVal` Binary
`FailurePoint` HexInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Winsock-Sockets/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 8,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1600,
      "thread_id": 2332
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Winsock-Sockets",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:34:28.262Z",
    "version": 0
  },
  "event_data": {
    "ErrorCode": "00000000",
    "FailurePoint": "00000000",
    "Level": 41,
    "OptLen": 4,
    "OptName": 27,
    "OptVal": "00000000",
    "Socket": "0x8BC"
  },
  "message": ""
}

Event ID 9: SockConnectStart

Channel: Operational
Level: Verbose
Task: SockConnect
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Winsock-Sockets/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 9,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8552,
      "thread_id": 12732
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Winsock-Sockets",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:34:36.134Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 10: SockConnectStop

Channel: Operational
Level: Informational
Task: SockConnect
Opcode: Stop

Fields #

Name	Description
`ErrorCode` HexInt32
`Socket` Pointer
`AddressLength` UInt32
`Address` Binary
`FailurePoint` HexInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Winsock-Sockets/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 10,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8552,
      "thread_id": 12732
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Winsock-Sockets",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:34:36.135Z",
    "version": 0
  },
  "event_data": {
    "Address": "020001BB010101010000000000000000",
    "AddressLength": 16,
    "ErrorCode": "33270000",
    "FailurePoint": "00020000",
    "Socket": "0x10E4"
  },
  "message": ""
}

Event ID 11: SockBindStart

Channel: Operational
Level: Verbose
Task: SockBind
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Winsock-Sockets/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 11,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1600,
      "thread_id": 3748
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Winsock-Sockets",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:34:28.342Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 12: SockBindStop

Channel: Operational
Level: Informational
Task: SockBind
Opcode: Stop

Fields #

Name	Description
`ErrorCode` HexInt32
`Socket` Pointer
`AddressLength` UInt32
`Address` Binary
`FailurePoint` HexInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Winsock-Sockets/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 12,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1600,
      "thread_id": 3748
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Winsock-Sockets",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:34:28.342Z",
    "version": 0
  },
  "event_data": {
    "Address": "0200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
    "AddressLength": 128,
    "ErrorCode": "00000000",
    "FailurePoint": "00000000",
    "Socket": "0x73C"
  },
  "message": ""
}

Event ID 13: SockGetOptStart

Channel: Operational
Level: Verbose
Task: SockGetOpt
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Winsock-Sockets/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 13,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1600,
      "thread_id": 3748
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Winsock-Sockets",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:34:28.343Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 14: SockGetOptStop

Channel: Operational
Level: Informational
Task: SockGetOpt
Opcode: Stop

Fields #

Name	Description
`ErrorCode` HexInt32
`Socket` Pointer
`Level` Int32
`OptName` Int32
`OptLen` UInt32
`OptVal` Binary
`FailurePoint` HexInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Winsock-Sockets/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 14,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1600,
      "thread_id": 3748
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Winsock-Sockets",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:34:28.346Z",
    "version": 0
  },
  "event_data": {
    "ErrorCode": "00000000",
    "FailurePoint": "00000000",
    "Level": 65535,
    "OptLen": 628,
    "OptName": 8197,
    "OptVal": "6600020000000000000000000000000008000000A01A0FE78BABCF118CA300805F48A192F1030000010000000000000000000000000000000000000000000000000000000000000002000000020000001000000010000000010000000600000000000000000000000000000000000000000000004D00530041004600440020005400630070006900700020005B005400430050002F00490050005D00000032005C006D007300770073006F0063006B002E0064006C006C002C002D003600300031003000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
    "Socket": "0x73C"
  },
  "message": ""
}

Event ID 15: SockListenStart

Channel: Operational
Task: SockListen
Opcode: Start

Event ID 16: SockListenStop

Channel: Operational
Task: SockListen
Opcode: Stop

Fields #

Name	Description
`ErrorCode` HexInt32
`Socket` Pointer
`Backlog` Int32
`FailurePoint` HexInt32

Provenance

ETW provider GUID {BDE46AEA-2357-51FE-7367-D5296F530BD1}

Defined in ws2_32.dll, which carries the event manifest.

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB