Microsoft-Windows-DLNA-Namespace

10 events across 1 channel

Event	Title	Channel
1001	GetThumbnailProviderStart	Analytic
1002	GetThumbnailProviderStop	Analytic
1003	BrowseStart	Analytic
1004	BrowseStop	Analytic
1005	SearchStart	Analytic
1006	SearchStop	Analytic
1007	Results2ShellPropertiesStart	Analytic
1008	Results2ShellPropertiesStop	Analytic
1009	Discover	Analytic
1010	Add	Analytic

Event ID 1001: GetThumbnailProviderStart

Provider: Microsoft-Windows-DLNA-Namespace
Channel: Analytic
Task: GetThumbnailProvider
Opcode: Start

Fields #

Name	Description
`HResultParam` UInt32

Event ID 1002: GetThumbnailProviderStop

Provider: Microsoft-Windows-DLNA-Namespace
Channel: Analytic
Task: GetThumbnailProvider
Opcode: Stop

Fields #

Name	Description
`HResultParam` UInt32

Event ID 1003: BrowseStart

Provider: Microsoft-Windows-DLNA-Namespace
Channel: Analytic
Task: Browse
Opcode: Start

Fields #

Name	Description
`ObjectID` UnicodeString
`IsBrowseDirectChildren` UInt32
`Filter` UnicodeString
`SortCriteria` UnicodeString
`StartingOffset` UInt32
`NumItemsToRetrieve` UInt32
`NumItemsReturned` UInt32
`NumItemsMatched` UInt32
`HResultParam` UInt32

Event ID 1004: BrowseStop

Provider: Microsoft-Windows-DLNA-Namespace
Channel: Analytic
Task: Browse
Opcode: Stop

Fields #

Name	Description
`ObjectID` UnicodeString
`IsBrowseDirectChildren` UInt32
`Filter` UnicodeString
`SortCriteria` UnicodeString
`StartingOffset` UInt32
`NumItemsToRetrieve` UInt32
`NumItemsReturned` UInt32
`NumItemsMatched` UInt32
`HResultParam` UInt32

Event ID 1005: SearchStart

Provider: Microsoft-Windows-DLNA-Namespace
Channel: Analytic
Task: Search
Opcode: Start

Fields #

Name	Description
`ObjectID` UnicodeString
`SearchCriteria` UnicodeString
`Filter` UnicodeString
`SortCriteria` UnicodeString
`StartingOffset` UInt32
`NumItemsToRetrieve` UInt32
`NumItemsReturned` UInt32
`NumItemsMatched` UInt32
`HResultParam` UInt32

Event ID 1006: SearchStop

Provider: Microsoft-Windows-DLNA-Namespace
Channel: Analytic
Task: Search
Opcode: Stop

Fields #

Name	Description
`ObjectID` UnicodeString
`SearchCriteria` UnicodeString
`Filter` UnicodeString
`SortCriteria` UnicodeString
`StartingOffset` UInt32
`NumItemsToRetrieve` UInt32
`NumItemsReturned` UInt32
`NumItemsMatched` UInt32
`HResultParam` UInt32

Event ID 1007: Results2ShellPropertiesStart

Provider: Microsoft-Windows-DLNA-Namespace
Channel: Analytic
Task: Results2ShellProperties
Opcode: Start

Event ID 1008: Results2ShellPropertiesStop

Provider: Microsoft-Windows-DLNA-Namespace
Channel: Analytic
Task: Results2ShellProperties
Opcode: Stop

Event ID 1009: Discover

Provider: Microsoft-Windows-DLNA-Namespace
Channel: Analytic
Task: Discover

Event ID 1010: Add

Provider: Microsoft-Windows-DLNA-Namespace
Channel: Analytic
Task: Add

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID d38fb874-33e4-4dcf-911e-1b53bb106d53

Defined in dlnashext.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Microsoft-Windows-DLNA-Namespace registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-DLNA-Namespace registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-DLNA-Namespace

Event ID 1001: GetThumbnailProviderStart

Fields #

Event ID 1002: GetThumbnailProviderStop

Fields #

Event ID 1003: BrowseStart

Fields #

Event ID 1004: BrowseStop

Fields #

Event ID 1005: SearchStart

Fields #

Event ID 1006: SearchStop

Fields #

Event ID 1007: Results2ShellPropertiesStart

Event ID 1008: Results2ShellPropertiesStop

Event ID 1009: Discover

Event ID 1010: Add

Provenance

Downloads

Credits

Keyboard shortcuts

Search operators