detection.wiki

Microsoft-Windows-Winsock-SQM

EventTitleChannelSampleRule
5task_0OperationalNN
10task_010OperationalNN
11task_011OperationalNN

Event ID 5: task_0

#
Channel
Operational

Fields #

NameDescription
SqmType UInt32
SqmSessionGuid GUID
SqmID UInt32
SqmDWORDDatapointValue UInt32

Event ID 10: task_010

#
Channel
Operational

Fields #

NameDescription
SqmType UInt32
SqmSessionGuid GUID
SqmID UInt32
SqmStringDatapointValue UnicodeString

Event ID 11: task_011

#
Channel
Operational

Fields #

NameDescription
SqmType UInt32
SqmSessionGuid GUID
SqmID UInt32
SqmStreamRowLength UInt32
SqmStreamRow Int16

Provenance

ETW provider GUID 093da50c-0bb9-4d7d-b95c-3bb9fcda5ee8

Defined in afd.sys, the binary that emits these events.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4171, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB