detection.wiki

Microsoft-Windows-WlanDlg

EventTitleChannelSampleRule
8001KeyPage_ShownStopAnalyticNN
8002Leaving_KeyPageStartAnalyticNN

Event ID 8001: KeyPage_ShownStop

#
Channel
Analytic
Task
KeyPage_Shown
Opcode
Stop

Event ID 8002: Leaving_KeyPageStart

#
Channel
Analytic
Task
Leaving_KeyPage
Opcode
Start

Provenance

ETW provider GUID d4afa0dc-4dd1-40af-afce-cb0d0e6736a7

Defined in Wlandlg.dll, which carries the event manifest.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB