Microsoft-Antimalware-Engine

109 events across 1 channel

Event ID	Title	Channel
1	Start of engine scan request	Application
2	End of engine scan request	Application
3		Application
4		Application
5	Start of stream scan request	Application
6	End of stream scan request	Application
7	Skipped file	Application
8		Application
9		Application
10		Application
11		Application
12		Application
13		Application
14		Application
15		Application
16		Application
17		Application
18		Application
19		Application
20		Application
21		Application
22		Application
23		Application
24		Application
25		Application
26		Application
27		Application
28		Application
29		Application
30		Application
31		Application
32		Application
33		Application
35		Application
36		Application
37		Application
38		Application
39		Application
40		Application
41		Application
42		Application
43		Application
44		Application
45		Application
46		Application
47		Application
48		Application
49		Application
50		Application
51		Application
52		Application
53		Application
58		Application
59		Application
60		Application
61		Application
62		Application
63		Application
64		Application
65		Application
66		Application
67		Application
68		Application
69		Application
70		Application
71		Application
72		Application
73		Application
74		Application
75		Application
76		Application
77		Application
78		Application
79		Application
80		Application
81		Application
82		Application
83		Application
84		Application
85		Application
86		Application
87		Application
88		Application
89		Application
90		Application
91		Application
92		Application
93		Application
94		Application
95		Application
96		Application
97		Application
98		Application
99		Application
100		Application
101		Application
102		Application
103		Application
104		Application
105		Application
106		Application
107		Application
108		Application
109		Application
110		Application
111		Application
112		Application
113		Application
114		Application

Event ID 1 — Start of engine scan request

Provider: Microsoft-Antimalware-Engine
Channel: Application

Message

Start of engine scan request

Fields

Name	Description
`EngineId`	—
`Id`	—
`Type`	—
`Flags`	—
`ScanSource`	—
`ResourceCount`	—
`FirstResourceType`	—
`FirstResourcePath`	—
`ThreadTime`	—

Event ID 2 — End of engine scan request

Provider: Microsoft-Antimalware-Engine
Channel: Application

Message

End of engine scan request

Fields

Name	Description
`EngineId`	—
`Id`	—
`Type`	—
`Flags`	—
`ScanSource`	—
`ResourceCount`	—
`FirstResourceType`	—
`FirstResourcePath`	—
`ThreadTime`	—
`StartQPC`	—

Event ID 3 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`Message`	—

Event ID 4 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineVersion`	—
`AVVersion`	—
`ASVersion`	—

Event ID 5 — Start of stream scan request

Provider: Microsoft-Antimalware-Engine
Channel: Application

Message

Start of stream scan request

Fields

Name	Description
`Id`	—
`Path`	—
`Process`	—
`Reason`	—
`ThreadTime`	—
`PID`	—

Event ID 6 — End of stream scan request

Provider: Microsoft-Antimalware-Engine
Channel: Application

Message

End of stream scan request

Fields

Name	Description
`Id`	—
`Path`	—
`Process`	—
`Reason`	—
`ThreadTime`	—
`PID`	—

Event ID 7 — Skipped file

Provider: Microsoft-Antimalware-Engine
Channel: Application

Message

Skipped file

Fields

Name	Description
`Path`	—
`Reason`	—

Event ID 8 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`GUID`	—
`Type`	—
`Name`	—
`SignatureId`	—
`ImagePath`	—

Event ID 9 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`PPID`	—
`ImagePath`	—
`Flags`	—

Event ID 10 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`ImagePath`	—

Event ID 11 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`ImagePath`	—

Event ID 12 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`ImageName`	—
`FileName`	—

Event ID 13 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`FileName`	—

Event ID 14 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`FileName`	—

Event ID 15 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`FileName`	—

Event ID 16 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`FileName`	—
`OldFileName`	—

Event ID 17 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`KeyPath`	—

Event ID 18 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`KeyPath`	—

Event ID 19 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`KeyPath`	—

Event ID 20 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`KeyPath`	—
`ValueName`	—

Event ID 21 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`KeyPath`	—
`ValueName`	—

Event ID 22 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—

Event ID 23 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—

Event ID 24 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—

Event ID 25 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—

Event ID 26 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—

Event ID 27 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`DetectionId`	—

Event ID 28 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`RecordType`	—
`ImagePath`	—
`Path`	—

Event ID 29 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`TPID`	—
`TTID`	—
`ImageName`	—

Event ID 30 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`FilePath`	—
`ThreadTime`	—

Event ID 31 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`FilePath`	—
`ThreadTime`	—
`StartQPC`	—

Event ID 32 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`FilePath`	—
`PID`	—
`ThreadTime`	—

Event ID 33 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`FilePath`	—
`PID`	—
`ThreadTime`	—
`StartQPC`	—

Event ID 35 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`ScanSource`	—
`EventType`	—
`Classification`	—
`Info`	—
`FileName`	—
`FileID`	—
`FileUSN`	—
`Result`	—

Event ID 36 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`ScanSource`	—
`EventType`	—
`Classification`	—
`Info`	—
`FileName`	—
`FileID`	—
`FileUSN`	—
`Result`	—

Event ID 37 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`ScanSource`	—
`EventType`	—
`Classification`	—
`Info`	—
`FileName`	—
`FileID`	—
`FileUSN`	—
`Result`	—

Event ID 38 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`FileName`	—
`CacheName`	—
`Result`	—

Event ID 39 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`FileName`	—
`CacheName`	—
`Result`	—

Event ID 40 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`action`	—
`key`	—
`filename`	—
`result`	—

Event ID 41 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`utilization`	—
`result`	—

Event ID 42 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`key`	—
`filename`	—
`parentKey`	—
`result`	—

Event ID 43 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`Message`	—
`Name`	—
`Data`	—
`StartStop`	—
`ThreadTime`	—

Event ID 44 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`action`	—
`vault`	—
`key`	—
`result`	—

Event ID 45 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`vault`	—
`records`	—
`result`	—

Event ID 46 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`KeyPath`	—

Event ID 47 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`KeyPath`	—

Event ID 48 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`KeyPath`	—

Event ID 49 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`KeyPath`	—

Event ID 50 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`KeyPath`	—

Event ID 51 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`KeyPath`	—

Event ID 52 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`KeyPath`	—

Event ID 53 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`TargetPID`	—
`AccessMask`	—
`WasHardened`	—

Event ID 58 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`KeyPath`	—

Event ID 59 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`VName`	—
`SigSeq`	—
`SigSha`	—
`Result`	—

Event ID 60 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`Channel`	—
`EventId`	—

Event ID 61 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`FolderName`	—

Event ID 62 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`Count`	—

Event ID 63 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`TaintReason`	—
`ReasonImagePath`	—
`ProcessImagePath`	—

Event ID 64 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`FileName`	—
`OldFileName`	—

Event ID 65 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`FolderName`	—

Event ID 66 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`FileName`	—
`FileHardLinkName`	—

Event ID 67 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`Message`	—
`Name`	—
`Data`	—
`StartStop`	—
`ThreadTime`	—
`DeltaCPU`	—
`DeltaWall`	—

Event ID 68 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`SigName`	—
`SigSeq`	—
`SigSha`	—
`SigTypeName`	—
`Dimension`	—
`Value`	—
`Limit`	—
`FileName`	—
`VPath`	—
`FileSha1`	—
`PartialCRC1`	—
`PartialCRC2`	—
`PartialCRC3`	—
`FileSize`	—

Event ID 69 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`Guid`	—
`VolumeSize`	—
`Attributes`	—
`FilesCount`	—
`FileGuidsArray`	—
`FileSizeArray`	—
`CompressedFileSizeArray`	—
`FileNameArray`	—
`FileAttributesArray`	—
`EfiFileTypeArray`	—
`FileSha1Array`	—
`SmbiosAttributes`	—
`FileCRCsArray`	—

Event ID 70 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`BasePath`	—
`CommandLine`	—
`PID`	—
`ParentPID`	—
`Flags`	—
`IntegrityLevel`	—

Event ID 71 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`FileName`	—

Event ID 72 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`FileName`	—

Event ID 73 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`CreationTime`	—
`PID`	—
`filepath`	—
`flags`	—
`flags2low`	—
`flags2high`	—
`oldFlags`	—
`oldFlags2low`	—
`oldFlags2high`	—
`Source`	—

Event ID 74 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`Sha1`	—
`Sha256`	—
`SigSeq`	—
`SigSha`	—
`AllSigSeqs`	—
`AllSigShas`	—
`RealPath`	—
`VPath`	—
`EtwDataReportType`	—
`ReportType`	—
`EngineReportGuid`	—
`ResourceData`	—
`ResourceSchema`	—
`Determination`	—
`ActionStatus`	—
`ProcessID`	—
`ProcessCreationTime`	—
`ProcessPath`	—
`ThreatName`	—
`Classification`	—
`IsLatent`	—
`IsPassiveMode`	—
`ScanSource`	—
`ScanType`	—
`RtpProcessID`	—
`RtpProcessCreationTime`	—
`ProcessCommandLine`	—
`ExtraDataJson`	—

Event ID 75 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`DeviceInfo`	—
`TCGEventsArray`	—
`PCRsArray`	—

Event ID 76 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`JsonData`	—

Event ID 77 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`ProcessId`	—
`CreationTime`	—
`Level`	—
`EffectiveLevel`	—
`TriggerSigSeq`	—
`Origin`	—

Event ID 78 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`ImageFilePath`	—
`Level`	—
`EffectiveLevel`	—
`TriggerSigSeq`	—
`Origin`	—

Event ID 79 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`ProcessId`	—
`CreationTime`	—
`Level`	—
`TriggerSigSeq`	—

Event ID 80 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`ProcessId`	—
`CreationTime`	—
`Level`	—
`TriggerSigSeq`	—
`StopReason`	—

Event ID 81 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`ProcessId`	—
`CreationTime`	—
`ScanReason`	—

Event ID 82 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`ProcessId`	—
`CreationTime`	—
`ScanReason`	—
`ScanResult`	—

Event ID 83 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—

Event ID 84 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—

Event ID 85 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—

Event ID 86 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—

Event ID 87 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`EngineVersion`	—
`AVVersion`	—
`ASVersion`	—

Event ID 88 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`EngineVersion`	—
`AVVersion`	—
`ASVersion`	—

Event ID 89 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`EngineVersion`	—
`AVVersion`	—
`ASVersion`	—

Event ID 90 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`EngineVersion`	—
`AVVersion`	—
`ASVersion`	—

Event ID 91 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`FilePath`	—
`ThreadId`	—
`StartQPC`	—

Event ID 92 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`FilePath`	—
`ThreadId`	—
`StartQPC`	—

Event ID 93 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`FilePath`	—
`PID`	—
`ThreadId`	—
`StartQPC`	—

Event ID 94 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`FilePath`	—
`PID`	—
`ThreadId`	—
`StartQPC`	—

Event ID 95 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`ProcessId`	—
`CreationTime`	—
`FileName`	—
`FirstOffsetWritten`	—
`LastOffsetWritten`	—
`SmallestOffsetWritten`	—
`BiggestOffsetWritten`	—
`TotalSizeOfWrites`	—
`TotalSizeOfAppends`	—
`NumberOfWrites`	—

Event ID 96 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`OnboardedInfo`	—

Event ID 97 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`Id`	—
`Type`	—
`Flags`	—
`ScanSource`	—
`ResourceCount`	—
`FirstResourceType`	—
`FirstResourcePath`	—
`ThreadId`	—
`StartQPC`	—

Event ID 98 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`Id`	—
`Type`	—
`Flags`	—
`ScanSource`	—
`ResourceCount`	—
`FirstResourceType`	—
`FirstResourcePath`	—
`ThreadId`	—
`StartQPC`	—

Event ID 99 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`CreationTime`	—
`PID`	—
`flags`	—
`flags2low`	—
`flags2high`	—

Event ID 100 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`CreationTime`	—
`PID`	—
`flags`	—
`flags2low`	—
`flags2high`	—

Event ID 101 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`EngineVersion`	—
`AVVersion`	—
`ASVersion`	—

Event ID 102 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`EngineVersion`	—
`AVVersion`	—
`ASVersion`	—

Event ID 103 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`FileName`	—

Event ID 104 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`FeatureId`	—
`FirstParam`	—
`SecondParam`	—

Event ID 105 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`EventId`	—
`KeyPath`	—
`ValueName`	—
`OldValue`	—
`NewValue`	—
`UserMode`	—
`FeatureType`	—

Event ID 106 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`LiveContextCount`	—
`TotalContextCount`	—

Event ID 107 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`EngineId`	—
`LiveContextCount`	—
`TotalContextCount`	—

Event ID 108 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`Type`	—
`Scope`	—
`ResourceType`	—
`TargetResource`	—
`ParentResource`	—
`DetectionName`	—
`UserName`	—

Event ID 109 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`ProcessContextId`	—
`ImagePath`	—

Event ID 110 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`ProcessContextId`	—
`TerminationTime`	—

Event ID 111 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`AttrId`	—
`AttrSeq`	—
`AttrSubset`	—

Event ID 112 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`AttrId`	—
`AttrSeq`	—
`AttrSubset`	—
`MatchedThreatsNumber`	—
`IsMultiProcMatch`	—
`IsMultiProcDetection`	—

Event ID 113 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`DetectionName`	—
`SigSeq`	—

Event ID 114 —

Provider: Microsoft-Antimalware-Engine
Channel: Application

Fields

Name	Description
`PID`	—
`DetectionName`	—
`SigSeq`	—
`CloudResponse`	—