detection.wiki

Microsoft-Windows-Diagnostics-Performance › Event 200

Event ID 200 — Windows has shutdown.

Provider
Microsoft-Windows-Diagnostics-Performance
Channel
Operational
Level
Warning
Task
ShutdownPerformanceMonitoring
Opcode
ShutdownInformation

Description

Windows has shutdown.

Message #

Windows has shutdown: 

     Shutdown Duration	: %4ms

     IsDegradation		: %16

     Incident Time (UTC)	: %2

Fields #

NameDescription
ShutdownTsVersion UInt32—
ShutdownStartTime FILETIME—
ShutdownEndTime FILETIME—
ShutdownTime UInt32—
ShutdownUserSessionTime UInt32—
ShutdownUserPolicyTime UInt32—
ShutdownUserProfilesTime UInt32—
ShutdownSystemSessionsTime UInt32—
ShutdownPreShutdownNotificationsTime UInt32—
ShutdownServicesTime UInt32—
ShutdownKernelTime UInt32—
ShutdownRootCauseStepImprovementBits UInt32—
ShutdownRootCauseGradualImprovementBits UInt32—
ShutdownRootCauseStepDegradationBits UInt32—
ShutdownRootCauseGradualDegradationBits UInt32—
ShutdownIsDegradation Boolean—
ShutdownTimeChange Int32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Diagnostics-Performance",
    "guid": "CFC18EC0-96B1-4EBA-961B-622CAEE05B0A",
    "event_source_name": "",
    "event_id": 200,
    "version": 1,
    "level": 3,
    "task": 4007,
    "opcode": 40,
    "keywords": 9223372036854841344,
    "time_created": "2023-11-05T22:33:56.991516+00:00",
    "event_record_id": 36,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0001-FD89-DBE43710DA01"
    },
    "execution": {
      "process_id": 3160,
      "thread_id": 3468
    },
    "channel": "Microsoft-Windows-Diagnostics-Performance/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "ShutdownTsVersion": 1,
    "ShutdownStartTime": "2023-11-05T22:31:30.287074Z",
    "ShutdownEndTime": "2023-11-05T22:31:43.106260Z",
    "ShutdownTime": 12819,
    "ShutdownUserSessionTime": 3778,
    "ShutdownUserPolicyTime": 17,
    "ShutdownUserProfilesTime": 236,
    "ShutdownSystemSessionsTime": 6148,
    "ShutdownPreShutdownNotificationsTime": 1596,
    "ShutdownServicesTime": 4185,
    "ShutdownKernelTime": 2892,
    "ShutdownRootCauseStepImprovementBits": 0,
    "ShutdownRootCauseGradualImprovementBits": 0,
    "ShutdownRootCauseStepDegradationBits": 72,
    "ShutdownRootCauseGradualDegradationBits": 0,
    "ShutdownIsDegradation": true,
    "ShutdownTimeChange": 0
  },
  "message": ""
}

References #