Microsoft-Windows-DesktopActivityModerator

21 events across 1 channel

Event	Title	Channel
1	StartDriverStart	Diagnostic
4	StartDriver	Diagnostic
9	StartDriverStop	Diagnostic
11	StopDriverStart	Diagnostic
19	StopDriverStop	Diagnostic
21	SuspendResumeStart	Diagnostic
22	SuspendResumeStop	Diagnostic
23	ThrottleStart	Diagnostic
24	ThrottleStop	Diagnostic
25	ResiliencyEngageStart	Diagnostic
26	ResiliencyEngageStop	Diagnostic
31	ProcessActivityStart	Diagnostic
32	ProcessActivityStop	Diagnostic
41	ProcessExempt	Diagnostic
42	PolicyReload	Diagnostic
51	PdcCallback	Diagnostic
52	PdcCallback52	Diagnostic
53	PdcCallback53	Diagnostic
54	PdcAcknowledge	Diagnostic
60	IoTrackingPerfTrack	Diagnostic
61	IoTrackingCallback	Diagnostic

Event ID 1: StartDriverStart

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: StartDriver
Opcode: Start

Event ID 4: StartDriver

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: StartDriver

Event ID 9: StartDriverStop

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: StartDriver
Opcode: Stop

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 11: StopDriverStart

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: StopDriver
Opcode: Start

Event ID 19: StopDriverStop

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: StopDriver
Opcode: Stop

Event ID 21: SuspendResumeStart

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: SuspendResume
Opcode: Start

Fields #

Name	Description
`SuspendFlag` Boolean

Event ID 22: SuspendResumeStop

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: SuspendResume
Opcode: Stop

Fields #

Name	Description
`SuspendFlag` Boolean

Event ID 23: ThrottleStart

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: Throttle
Opcode: Start

Fields #

Name	Description
`SuspendFlag` Boolean

Event ID 24: ThrottleStop

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: Throttle
Opcode: Stop

Fields #

Name	Description
`SuspendFlag` Boolean

Event ID 25: ResiliencyEngageStart

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: ResiliencyEngage
Opcode: Start

Fields #

Name	Description
`ActiveFlag` Boolean

Event ID 26: ResiliencyEngageStop

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: ResiliencyEngage
Opcode: Stop

Fields #

Name	Description
`ActiveFlag` Boolean

Event ID 31: ProcessActivityStart

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: ProcessActivity
Opcode: Start

Fields #

Name	Description
`ProcessId` UInt32
`SessionId` UInt32
`ImageFileNameLength` UInt16
`ImageFileName` UnicodeString
`CommandLineLength` UInt16
`CommandLine` UnicodeString

Event ID 32: ProcessActivityStop

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: ProcessActivity
Opcode: Stop

Fields #

Name	Description
`ProcessId` UInt32
`SessionId` UInt32

Event ID 41: ProcessExempt

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: ProcessExempt

Fields #

Name	Description
`ProcessId` UInt32
`SessionId` UInt32
`ExemptGroup` UInt32
`RegisterAtLaunch` Boolean

Event ID 42: PolicyReload

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: PolicyReload

Fields #

Name	Description
`PolicyRecords` UInt32

Event ID 51: PdcCallback

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: PdcCallback

Fields #

Name	Description
`State` UInt32
`NTSTATUS` UInt32
`WorkItemQueued` Boolean

Event ID 52: PdcCallback52

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: PdcCallback

Fields #

Name	Description
`ClientState` UInt32

Event ID 53: PdcCallback53

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: PdcCallback

Fields #

Name	Description
`Flags` UInt32

Event ID 54: PdcAcknowledge

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: PdcAcknowledge

Event ID 60: IoTrackingPerfTrack

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: IoTrackingPerfTrack
Opcode: Info

Fields #

Name	Description
`DeviceBucket` UInt32
`ElapsedTimeMs` UInt32
`FastIoCount` UInt32
`SlowIoCount` UInt32

Event ID 61: IoTrackingCallback

Provider: Microsoft-Windows-DesktopActivityModerator
Channel: Diagnostic
Task: IoTrackingCallback
Opcode: Info

Fields #

Name	Description
`DeviceType` UInt16
`DeviceBucket` UInt32
`ElapsedTime` UInt64
`SlowIo` Boolean

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 32dd13df-9c0b-4c3b-b854-ee76c050f5f4

Defined in dam.sys, the binary that emits these events.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.5074 · captured 2026-06-02

Downloads

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)