RmClient_RestartManager
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 10000 | Event ID 10000 | Unknown | N | N |
| 10001 | Event ID 10001 | Unknown | N | N |
| 10002 | Event ID 10002 | Unknown | N | N |
| 10003 | Event ID 10003 | Unknown | N | N |
| 10004 | Event ID 10004 | Unknown | N | N |
| 10005 | Event ID 10005 | Unknown | N | N |
| 10006 | Event ID 10006 | Unknown | N | N |
| 10007 | Event ID 10007 | Unknown | N | N |
| 10008 | Event ID 10008 | Unknown | N | N |
| 10009 | Event ID 10009 | Unknown | N | N |
| 10010 | Event ID 10010 | Unknown | N | N |
Event ID 10002
#Fields #
| Name | Description |
|---|---|
RmSessionId UInt32 | |
FullPath UnicodeString | |
DisplayName UnicodeString | |
AppVersion UInt32 | |
AppType UInt32 | |
TSSessionId UInt32 | |
Status UInt32 | NTSTATUS reference |
Pid UInt32 | |
nFiles UInt32 | |
File UnicodeString |
Event ID 10003
#Fields #
| Name | Description |
|---|---|
RmSessionId UInt32 | |
FullPath UnicodeString | |
DisplayName UnicodeString | |
AppVersion UInt32 | |
AppType UInt32 | |
TSSessionId UInt32 | |
Status UInt32 | NTSTATUS reference |
Pid UInt32 | |
nFiles UInt32 | |
File UnicodeString |
Event ID 10004
#Fields #
| Name | Description |
|---|---|
RmSessionId UInt32 | |
nFiles UInt32 | |
nRegProcs UInt32 | |
nRegServices UInt32 | |
Files UnicodeString | |
RegProcs UnicodeString | |
RegServices UnicodeString |
Event ID 10005
#Fields #
| Name | Description |
|---|---|
RmSessionId UInt32 | |
nApplications UInt32 | |
Applications UnicodeString | |
dwRebootReasons UInt32 |
Event ID 10006
#Fields #
| Name | Description |
|---|---|
RmSessionId UInt32 | |
FullPath UnicodeString | |
DisplayName UnicodeString | |
AppVersion UInt32 | |
AppType UInt32 | |
TSSessionId UInt32 | |
Status UInt32 | NTSTATUS reference |
Pid UInt32 | |
nFiles UInt32 | |
File UnicodeString |
Event ID 10007
#Fields #
| Name | Description |
|---|---|
RmSessionId UInt32 | |
FullPath UnicodeString | |
DisplayName UnicodeString | |
AppVersion UInt32 | |
AppType UInt32 | |
TSSessionId UInt32 | |
Status UInt32 | NTSTATUS reference |
Pid UInt32 | |
nFiles UInt32 | |
File UnicodeString |
Event ID 10009
#Fields #
| Name | Description |
|---|---|
RmSessionId UInt32 | |
SvcHostPid UInt32 | |
nFiles UInt32 | |
nServices UInt32 | |
FileName UnicodeString | |
Service UnicodeString |
Event ID 10010
#Fields #
| Name | Description |
|---|---|
RmSessionId UInt32 | |
Pid UInt32 | |
FullPath UnicodeString | |
DisplayName UnicodeString | |
AppVersion UInt32 | |
AppType UInt32 | |
TSSessionId UInt32 | |
Status UInt32 | NTSTATUS reference |
Reason UInt32 |