detection.wiki
Blog

Microsoft-Windows-Crypto-NCrypt

26 events across 3 channels

Event IDTitleChannel
1Cryptographic Operation failed.Operational
2Open Provider operation failed.Operational
3Open Key operation failed.Operational
4Create Key operation failed.Operational
5Protect Key operation failed.Operational
6Unprotect Key operation failed.Operational
7Protect Secret operation failed.Operational
8Unprotect Secret operation failed.Operational
9Key write succeeded.Operational
10Key write failed.Operational
11Delete key succeeded.Operational
12Delete key failed.Operational
13VBS Key Isolation operation failed Function: %1 Info: %2 Status: %3 (%4).Operational
14VBS Key Isolation operation failed Function: %1 Info: %2 Status: %3 (%4) Client: …Operational
15New client uses VBS Key Isolation Name: %1 Binding status: %2 (%3) Client …Operational
16Cert-In-Use Message.CertInUse
17Cert-In-Use Failed.CertInUse
18Key Guard attestation operation failed Function: %1 Info: %2 Status: %3 (%4) …Operational
19Key Guard attestation operation failed Function: %1 Info: %2 Status: %3 (%4).Operational
20VBS Key Isolation is not available Error: %1 Failed to signal: %2 Signaled: %3.Operational
21Key write succeeded.KeyMgmt
22Delete key succeeded.KeyMgmt
23Capi1 Container write succeeded.KeyMgmt
24Capi1 Container Delete succeeded.KeyMgmt
25VBS Key Isolation status.Operational
26VBS Key Protection restart attempted LsaIsoLaunchAttempted: %1 Status: %2 …Operational

Event ID 1 — Cryptographic Operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational

Message

Cryptographic Operation failed.

 Cryptographic Parameters:
 	OperationType:	%1
 	Provider Name:	%2
 	Key Name:	%3
 	Key Type:	%4
 	Algorithm Name:	%5
 
Failure Information:
 	Return Code:	%6

Fields

NameDescription
OperationType[Cryptographic Parameters] OperationType.
Provider_Name[Cryptographic Parameters] Provider Name.
Key_Name[Cryptographic Parameters] Key Name.
Key_Type[Cryptographic Parameters] Key Type.
Algorithm_Name[Cryptographic Parameters] Algorithm Name.
Return_Code[Failure Information] Return Code.
ProviderName—
KeyName—
KeyType—
AlgorithmName—
Status—
ProcessName—

Event ID 2 — Open Provider operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Level
2
Samples
1

Message

Open Provider operation failed.

 Cryptographic Parameters:
 	Provider Name:	%1
 Failure Information:
 	Return Code:	%3

Fields

NameDescription
ProviderName[Cryptographic Parameters] Provider Name.
Status—
ProcessName[Failure Information] Return Code.

Example Event

system:
  provider: Microsoft-Windows-Crypto-NCrypt
  guid: E8ED09DC-100C-45E2-9FC8-B53399EC1F70
  event_source_name: ''
  event_id: 2
  version: 0
  level: 2
  task: 2
  opcode: 0
  keywords: 9223372036854775809
  time_created: '2023-11-06T06:25:39.826665+00:00'
  event_record_id: 24
  correlation:
    ActivityID: F590C418-1079-0001-5BC5-90F57910DA01
  execution:
    process_id: 808
    thread_id: 856
  channel: Microsoft-Windows-Crypto-NCrypt/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data:
  ProviderName: Microsoft Platform Crypto Provider
  Status: '0x80090030'
  ProcessName: lsass.exe
message: ''

References

Event ID 3 — Open Key operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Level
2
Samples
1

Message

Open Key operation failed.

 Cryptographic Parameters:
 	Provider Name:	%1
 	Key Name:	%2
 Failure Information:
 	Return Code:	%3

Fields

NameDescription
ProviderName[Cryptographic Parameters] Provider Name.
KeyName[Cryptographic Parameters] Key Name.
Status[Failure Information] Return Code.
ProcessName—

Example Event

system:
  provider: Microsoft-Windows-Crypto-NCrypt
  guid: E8ED09DC-100C-45E2-9FC8-B53399EC1F70
  event_source_name: ''
  event_id: 3
  version: 0
  level: 2
  task: 3
  opcode: 0
  keywords: 9223372036854775809
  time_created: '2023-11-05T22:28:56.226219+00:00'
  event_record_id: 30
  correlation: {}
  execution:
    process_id: 5416
    thread_id: 5476
  channel: Microsoft-Windows-Crypto-NCrypt/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-19
event_data:
  ProviderName: Microsoft Software Key Storage Provider
  KeyName: Microsoft Connected Devices Platform device certificate
  Status: '0x80090016'
  ProcessName: svchost.exe
message: ''

References

Event ID 4 — Create Key operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Level
2
Samples
1

Message

Create Key operation failed.

 Cryptographic Parameters:
 	Provider Name:	%1
 	Key Name:	%2
 	Algorithm Name:	%3
 	Flags:		%4
 Failure Information:
  	Return Code:	%5

Fields

NameDescription
ProviderName[Cryptographic Parameters] Provider Name.
KeyName[Cryptographic Parameters] Key Name.
AlgorithmName[Cryptographic Parameters] Algorithm Name.
Flags[Cryptographic Parameters] Flags.
Status[Failure Information] Return Code.
ProcessName—

Example Event

system:
  provider: Microsoft-Windows-Crypto-NCrypt
  guid: E8ED09DC-100C-45E2-9FC8-B53399EC1F70
  event_source_name: ''
  event_id: 4
  version: 0
  level: 2
  task: 4
  opcode: 0
  keywords: 9223372036854775809
  time_created: '2023-11-06T01:47:51.933305+00:00'
  event_record_id: 47
  correlation: {}
  execution:
    process_id: 13296
    thread_id: 8852
  channel: Microsoft-Windows-Crypto-NCrypt/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
  ProviderName: Microsoft Software Key Storage Provider
  KeyName: ChromeMetricsTestKey
  AlgorithmName: ECDSA_P256
  Flags: '0x20000'
  Status: '0x80090029'
  ProcessName: chrome.exe
message: ''

References

Event ID 5 — Protect Key operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational

Message

Protect Key operation failed.

 Cryptographic Parameters:
 	Protector Name:	%1
 	Protector Attributes:
			%2
 	Flags:		%3
 Failure Information:
 	Return Code:	%4

Fields

NameDescription
Protector_Name[Cryptographic Parameters] Protector Name.
Protector_Attributes—
Flags[Protector Attributes] Flags.
Return_Code[Failure Information] Return Code.
ProtectorName—
ProtectorAttributes—
Status—
ProcessName—

Event ID 6 — Unprotect Key operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational

Message

Unprotect Key operation failed.

 Cryptographic Parameters:
 	Protector Name:	%1
 	Recipient Type:	%2
 	Flags:		%3
 Failure Information:
 	Return Code:	%4

Fields

NameDescription
Protector_Name[Cryptographic Parameters] Protector Name.
Recipient_Type[Cryptographic Parameters] Recipient Type.
Flags[Cryptographic Parameters] Flags.
Return_Code[Failure Information] Return Code.
ProtectorName—
RecipientType—
Status—
ProcessName—
KeyIdLength—
KeyId—

Event ID 7 — Protect Secret operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational

Message

Protect Secret operation failed.

 Cryptographic Parameters:
 	Flags:		%1
 Failure Information:
 	Return Code:	%2

Fields

NameDescription
Flags[Cryptographic Parameters] Flags.
Return_Code[Failure Information] Return Code.
Status—
ProcessName—

Event ID 8 — Unprotect Secret operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational

Message

Unprotect Secret operation failed.

 Cryptographic Parameters:
 	Flags:		%1
 Failure Information:
 	Return Code:	%2

Fields

NameDescription
Flags[Cryptographic Parameters] Flags.
Return_Code[Failure Information] Return Code.
Status—
ProcessName—

Event ID 9 — Key write succeeded.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Level
5
Samples
1

Message

Key write succeeded.

 Provider Name:	%1
 ModificationType: 		%2
 Flags:		%3
 Key Name:	%4
 Key File Name:	%5
 ProcessName:	%6
 ProcessId:	%7
 ServerThreadId:	%8
 UserId:	%9
 ServiceTag:	%10
 Return Code:	%11

Fields

NameDescription
ProviderName—
KeyModificationTypeModificationType.
Flags—
KeyName—
KeyFileName—
ProcessName—
ProcessId—
ThreadIdServerThreadId.
UserId—
ServiceTag—
StatusReturn Code.

Example Event

system:
  provider: Microsoft-Windows-Crypto-NCrypt
  guid: E8ED09DC-100C-45E2-9FC8-B53399EC1F70
  event_source_name: ''
  event_id: 9
  version: 0
  level: 5
  task: 9
  opcode: 0
  keywords: 9223372036854775809
  time_created: '2023-11-05T22:28:56.259521+00:00'
  event_record_id: 31
  correlation: {}
  execution:
    process_id: 808
    thread_id: 856
  channel: Microsoft-Windows-Crypto-NCrypt/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-19
event_data:
  ProviderName: Microsoft Software Key Storage Provider
  KeyModificationType: '0x1'
  Flags: '0x0'
  KeyName: Microsoft Connected Devices Platform device certificate
  KeyFileName: de7cf8a7901d2ad13e5c67c29e5d1662_e56ada26-b69d-4d96-86fb-2b434b08d2d0
  ProcessName: C:\Windows\System32\svchost.exe
  ProcessId: '0x1528'
  ThreadId: '0x358'
  UserId: S-1-5-19
  ServiceTag: CDPSvc
  Status: '0x0'
message: ''

References

Event ID 10 — Key write failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational

Message

Key write failed.

 Provider Name:	%1
 ModificationType: 		%2
 Flags:		%3
 Key Name:	%4
 Key File Name:	%5
 ProcessName:	%6
 ProcessId:	%7
 ServerThreadId:	%8
 UserId:	%9
 ServiceTag:	%10
 Return Code:	%11

Fields

NameDescription
Provider_Name—
ModificationType—
Flags—
Key_Name—
Key_File_Name—
ProcessName—
ProcessId—
ServerThreadId—
UserId—
ServiceTag—
Return_Code—
ProviderName—
KeyModificationType—
KeyName—
KeyFileName—
ThreadId—
Status—

Event ID 11 — Delete key succeeded.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Level
5
Samples
1

Message

Delete key succeeded.

 Provider Name:	%1
 Flags:		%2
 DeletionType: 		%3
 Key Name:	%4
 Key File Name:	%5
 ProcessName:	%6
 ProcessId:	%7
 ServerThreadId:	%8
 UserId:	%9
 ServiceTag:	%10
 Return Code:	%11

Fields

NameDescription
ProviderName—
Flags—
DeletionType—
KeyName—
KeyFileName—
ProcessName—
ProcessId—
ThreadIdServerThreadId.
UserId—
ServiceTag—
StatusReturn Code.

Example Event

system:
  provider: Microsoft-Windows-Crypto-NCrypt
  guid: E8ED09DC-100C-45E2-9FC8-B53399EC1F70
  event_source_name: ''
  event_id: 11
  version: 0
  level: 5
  task: 11
  opcode: 0
  keywords: 9223372036854775809
  time_created: '2023-11-05T22:28:56.224021+00:00'
  event_record_id: 29
  correlation: {}
  execution:
    process_id: 808
    thread_id: 856
  channel: Microsoft-Windows-Crypto-NCrypt/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-19
event_data:
  ProviderName: Microsoft Software Key Storage Provider
  Flags: '0x40'
  DeletionType: '0x0'
  KeyName: Microsoft Connected Devices Platform device certificate
  KeyFileName: de7cf8a7901d2ad13e5c67c29e5d1662_31383106-803d-411b-9763-a28cdc0f0c3f
  ProcessName: C:\Windows\System32\svchost.exe
  ProcessId: '0x1528'
  ThreadId: '0x358'
  UserId: S-1-5-19
  ServiceTag: CDPSvc
  Status: '0x0'
message: ''

References

Event ID 12 — Delete key failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational

Message

Delete key failed.

 Provider Name:	%1
 Flags:		%2
 DeletionType: 		%3
 Key Name:	%4
 Key File Name:	%5
 ProcessName:	%6
 ProcessId:	%7
 ServerThreadId:	%8
 UserId:	%9
 ServiceTag:	%10
 Return Code:	%11

Fields

NameDescription
Provider_Name—
Flags—
DeletionType—
Key_Name—
Key_File_Name—
ProcessName—
ProcessId—
ServerThreadId—
UserId—
ServiceTag—
Return_Code—
ProviderName—
KeyName—
KeyFileName—
ThreadId—
Status—

Event ID 13 — VBS Key Isolation operation failed Function: %1 Info: %2 Status: %3 (%4).

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational

Message

VBS Key Isolation operation failed
Function: %1
Info: %2
Status: %3 (%4)

Fields

NameDescription
Function—
Info—
Status—
StatusCode—
StatusString—

Event ID 14 — VBS Key Isolation operation failed Function: %1 Info: %2 Status: %3 (%4) Client: %5 Client %1 failures: %6 Global %1 failures: %7 Global %1 success...

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational

Message

VBS Key Isolation operation failed
Function: %1
Info: %2
Status: %3 (%4)
Client: %5
Client %1 failures: %6
Global %1 failures: %7
Global %1 successes: %8

Fields

NameDescription
Function—
Info—
Status—
Client—
StatusCode—
StatusString—
FailuresCount—
FailuresCountGlobal—
SuccessCountGlobal—

Event ID 15 — New client uses VBS Key Isolation Name: %1 Binding status: %2 (%3) Client instance binding attempts: %4.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Level
4
Samples
1

Message

New client uses VBS Key Isolation
Name: %1
Binding status: %2 (%3)
Client instance binding attempts: %4

Fields

NameDescription
ClientName.
BindingStatusCodeBinding status.
BindingStatusString—
InstanceBindingAttemptsClient instance binding attempts.
ImageBindingAttemptsClient overall binding attempts.
ActiveInstances—
ActiveInstancesMax—
InstancesLifetimeInstances across lifetime.

Example Event

system:
  provider: Microsoft-Windows-Crypto-NCrypt
  guid: E8ED09DC-100C-45E2-9FC8-B53399EC1F70
  event_source_name: ''
  event_id: 15
  version: 0
  level: 4
  task: 13
  opcode: 0
  keywords: 9223372036854775816
  time_created: '2023-11-06T01:47:51.932692+00:00'
  event_record_id: 46
  correlation:
    ActivityID: E4DB489E-1037-0001-0C49-DBE43710DA01
  execution:
    process_id: 808
    thread_id: 15768
  channel: Microsoft-Windows-Crypto-NCrypt/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
  Client: chrome.exe
  BindingStatusCode: '0x80090029'
  BindingStatusString: -2146893783
  InstanceBindingAttempts: 1
  ImageBindingAttempts: 2
  ActiveInstances: 1
  ActiveInstancesMax: 1
  InstancesLifetime: 2
message: ''

References

Event ID 16 — Cert-In-Use Message.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
CertInUse

Message

Cert-In-Use 

 Message:
 %1

Fields

NameDescription
Message—

Event ID 17 — Cert-In-Use Failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
CertInUse

Message

Cert-In-Use Failed. 

 ErrorMessage:
 %1

Fields

NameDescription
ErrorMessage—
Message—

Event ID 18 — Key Guard attestation operation failed Function: %1 Info: %2 Status: %3 (%4) Global %1 failures: %5 Global %1 successes: %6.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational

Message

Key Guard attestation operation failed
Function: %1
Info: %2
Status: %3 (%4)
Global %1 failures: %5
Global %1 successes: %6

Fields

NameDescription
Function—
Info—
StatusCode—
StatusString—
FailuresCountGlobal—
SuccessCountGlobal—

Event ID 19 — Key Guard attestation operation failed Function: %1 Info: %2 Status: %3 (%4).

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational

Message

Key Guard attestation operation failed
Function: %1
Info: %2
Status: %3 (%4)

Fields

NameDescription
Function—
Info—
StatusCode—
StatusString—

Event ID 20 — VBS Key Isolation is not available Error: %1 Failed to signal: %2 Signaled: %3.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational

Message

VBS Key Isolation is not available
Error: %1
Failed to signal: %2
Signaled: %3

Fields

NameDescription
ErrorCode—
SignaledFailure—
SignaledSuccess—

Event ID 21 — Key write succeeded.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
KeyMgmt

Message

Key write succeeded.

 Provider Name:	%1
 ModificationType: 		%2
 Flags:		%3
 Key Name:	%4
 Key File Name:	%5
 ProcessName:	%6
 ProcessId:	%7
 ServerThreadId:	%8
 UserId:	%9
 ServiceTag:	%10
 Return Code:	%11

Fields

NameDescription
ProviderName—
KeyModificationType—
Flags—
KeyName—
KeyFileName—
ProcessName—
ProcessId—
ThreadId—
UserId—
ServiceTag—
Status—

Event ID 22 — Delete key succeeded.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
KeyMgmt

Message

Delete key succeeded.

 Provider Name:	%1
 Flags:		%2
 DeletionType: 		%3
 Key Name:	%4
 Key File Name:	%5
 ProcessName:	%6
 ProcessId:	%7
 ServerThreadId:	%8
 UserId:	%9
 ServiceTag:	%10
 Return Code:	%11

Fields

NameDescription
ProviderName—
Flags—
DeletionType—
KeyName—
KeyFileName—
ProcessName—
ProcessId—
ThreadId—
UserId—
ServiceTag—
Status—

Event ID 23 — Capi1 Container write succeeded.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
KeyMgmt

Message

Capi1 Container write succeeded.

 Key Name:	%1
 Key File Name:	%2
 ProcessName:	%3

Fields

NameDescription
KeyName—
KeyFileName—
ProcessName—

Event ID 24 — Capi1 Container Delete succeeded.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
KeyMgmt

Message

Capi1 Container Delete succeeded.

 Key Name:	%1
 Key File Name:	%2
 ProcessName:	%3

Fields

NameDescription
KeyName—
KeyFileName—
ProcessName—

Event ID 25 — VBS Key Isolation status.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational

Message

VBS Key Isolation status: %1

Fields

NameDescription
Status—

Event ID 26 — VBS Key Protection restart attempted LsaIsoLaunchAttempted: %1 Status: %2 TotalAttemptedRestarts: %3 TotalSuccessfulRestarts: %4 CanBeEnabled: %5.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational

Message

VBS Key Protection restart attempted
LsaIsoLaunchAttempted: %1
Status: %2
TotalAttemptedRestarts: %3
TotalSuccessfulRestarts: %4
CanBeEnabled: %5

Fields

NameDescription
LsaIsoLaunchAttempted—
Status—
TotalAttemptedRestarts—
TotalSuccessfulRestarts—
CanBeEnabled—