detection.wiki

Microsoft-Windows-WLAN-MediaManager

EventTitleChannelSampleRule
1Start create context menuDiagnosticNN
2Stop create context menuDiagnosticNN
3Show data usageDiagnosticNN
4Hide data usageDiagnosticNN
5Change network costDiagnosticNN

Event ID 1: Start create context menu

#
Channel
Diagnostic
Task
Create_Context_Menu
Opcode
Start

Event ID 2: Stop create context menu

#
Channel
Diagnostic
Task
Create_Context_Menu
Opcode
Stop

Event ID 3: Show data usage

#
Channel
Diagnostic
Task
Show_Data_Usage
Opcode
Info

Event ID 4: Hide data usage

#
Channel
Diagnostic
Task
Hide_Data_Usage
Opcode
Info

Event ID 5: Change network cost

#
Channel
Diagnostic
Task
Change_Network_Cost
Opcode
Info

Provenance

ETW provider GUID 323dad74-d3ec-44a8-8b9d-cafeb4999274

Defined in WlanMM.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB