Desktop Window Manager

6 events across 1 channel

Event ID	Title	Channel
9003		Application
9004		Application
9007		Application
9009	The Desktop Window Manager has exited with code (0x40010004)	Application
9016		Application
9027	The Desktop Window Manager has registered the session port.	Application

Event ID 9003 —

Provider: Desktop Window Manager
Channel: Application
Level: 4
Samples: 1

Example Event

system:
  provider: Desktop Window Manager
  guid: ''
  event_source_name: ''
  event_id: 9003
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 36028797018963968
  time_created: '2013-10-23T16:22:49+00:00'
  event_record_id: 88
  correlation: {}
  execution:
    process_id: 0
    thread_id: 0
  channel: Application
  computer: IE8Win7
  security:
    user_id: ''
event_data: {}
message: ''

References

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 9004 —

Provider: Desktop Window Manager
Channel: Application
Level: 4
Samples: 1

Example Event

system:
  provider: Desktop Window Manager
  guid: ''
  event_source_name: ''
  event_id: 9004
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 36028797018963968
  time_created: '2013-10-23T17:51:20+00:00'
  event_record_id: 234
  correlation: {}
  execution:
    process_id: 0
    thread_id: 0
  channel: Application
  computer: IE8Win7
  security:
    user_id: ''
event_data: {}
message: ''

References

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 9007 —

Provider: Desktop Window Manager
Channel: Application
Level: 4
Samples: 1

Example Event

system:
  provider: Desktop Window Manager
  guid: ''
  event_source_name: ''
  event_id: 9007
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 36028797018963968
  time_created: '2014-11-26T23:22:01.000000Z'
  event_record_id: 1151
  correlation: {}
  execution:
    process_id: 0
    thread_id: 0
  channel: Application
  computer: IE10Win7
  security:
    user_id: ''
event_data: {}

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 9009 — The Desktop Window Manager has exited with code (0x40010004)

Provider: Desktop Window Manager
Channel: Application
Level: 4
Samples: 1

Fields

Name	Description
`Data`	—

Example Event

system:
  provider: Desktop Window Manager
  guid: ''
  event_source_name: ''
  event_id: 9009
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 36028797018963968
  time_created: '2013-10-23T17:45:45+00:00'
  event_record_id: 208
  correlation: {}
  execution:
    process_id: 0
    thread_id: 0
  channel: Application
  computer: IE8Win7
  security:
    user_id: ''
event_data:
  Data:
  - '0x40010004'
message: The Desktop Window Manager has exited with code (0x40010004)

References

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 9016 —

Provider: Desktop Window Manager
Channel: Application
Level: 4
Samples: 1

Example Event

system:
  provider: Desktop Window Manager
  guid: ''
  event_source_name: ''
  event_id: 9016
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 36028797018963968
  time_created: '2014-11-26T23:26:01.000000Z'
  event_record_id: 1211
  correlation: {}
  execution:
    process_id: 0
    thread_id: 0
  channel: Application
  computer: IE10Win7
  security:
    user_id: ''
event_data: {}

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 9027 — The Desktop Window Manager has registered the session port.

Provider: Desktop Window Manager
Channel: Application
Level: 4
Samples: 1

Example Event

system:
  provider: Desktop Window Manager
  guid: ''
  event_source_name: ''
  event_id: 9027
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 36028797018963968
  time_created: '2022-04-07T16:53:28.968520+00:00'
  event_record_id: 194
  correlation: {}
  execution:
    process_id: 0
    thread_id: 0
  channel: Application
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: ''
event_data: {}
message: The Desktop Window Manager has registered the session port.

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline