Microsoft-Windows-DUSER

72 events across 1 channel

Event	Title	Channel
1	DUser_PaintStart	Diagnostic
2	DUser_PaintStop	Diagnostic
3	DUser_SyncAdaptorsStart	Diagnostic
4	DUser_SyncAdaptorsStop	Diagnostic
5	DUser_ResetInvalidStart	Diagnostic
6	DUser_ResetInvalidStop	Diagnostic
7	DUser_EndDrawBitBltStart	Diagnostic
8	DUser_EndDrawBitBltStop	Diagnostic
9	DUser_InputStart	Diagnostic
10	DUser_InputStop	Diagnostic
11	DUser_InputStart11	Diagnostic
12	DUser_LayeredCreateVisualsStart	Diagnostic
13	DUser_LayeredRemoveVisualsStart	Diagnostic
14	DUser_LayeredDestructVisualsStart	Diagnostic
15	DUser_DestroyPendingDCVisualsStart	Diagnostic
16	DUser_DestroyPendingDCVisualsStop	Diagnostic
17	DUser_ForceDestroyDCVisualStart	Diagnostic
18	DUser_RemoveAndDestroyDCVisualStart	Diagnostic
19	DUser_DrawLayeredGadgetStart	Diagnostic
20	DUser_DrawLayeredGadgetStart20	Diagnostic
21	DUser_LayeredGetBitmapStart	Diagnostic
22	DUser_LayeredSetContentStart	Diagnostic
24	DUser_LayerGadgetStart	Diagnostic
25	DUser_LayerGadgetStop	Diagnostic
26	DUser_LayerGadgetLoopStart	Diagnostic
27	DUser_LayerGadgetLoopStop	Diagnostic
28	DUser_CreateCompatibleBitmapStart	Diagnostic
29	DUser_CreateCompatibleBitmapStop	Diagnostic
30	DUser_InitPropertiesStart	Diagnostic
31	DUser_InitPropertiesStop	Diagnostic
32	DUser_AddChildVisualStart	Diagnostic
33	DUser_AddChildVisualStop	Diagnostic
34	DUser_MoveChildrenToParent	Diagnostic
35	DUser_MoveChildrenToParentStart	Diagnostic
36	DUser_MoveChildrenToParentStop	Diagnostic
37	DUser_Reparent	Diagnostic
38	DUser_ReparentStart	Diagnostic
39	DUser_ReparentStop	Diagnostic
40	DUser_AddWAMTransitionsStart	Diagnostic
41	DUser_AddWAMTransitionsStop	Diagnostic
42	DUser_CreateCubicBezierLinearVectorTransition	Diagnostic
43	DUser_ScheduleWAMStoryboardStart	Diagnostic
44	DUser_ScheduleWAMStoryboardStop	Diagnostic
45	DUser_GetCurve	Diagnostic
46	DUser_DCompCommitStart	Diagnostic
47	DUser_DCompCommitStop	Diagnostic
48	DUser_DCompCommit	Diagnostic
49	DUser_DrawDirtyLayers	Diagnostic
50	DUser_CommitFromWMPaint	Diagnostic
51	DUser_ScheduleTransitionsStart	Diagnostic
52	DUser_ScheduleTransitionsStop	Diagnostic
53	DUser_WAMDelayStart	Diagnostic
54	DUser_WAMDelayStop	Diagnostic
55	DUser_Input	Diagnostic
56	DUser_TransitionComplete	Diagnostic
65	DUser_IntervalAcquireRegionStart	Diagnostic
66	DUser_IntervalAcquireRegionStop	Diagnostic
67	DUser_IntervalReleaseRegionStart	Diagnostic
68	DUser_IntervalReleaseRegionStop	Diagnostic
71	DUser_CreateSurface	Diagnostic
72	DUser_DestroySurface	Diagnostic
75	DUser_ProcessPendingStoryboards	Diagnostic
76	DUser_TransitionScheduled	Diagnostic
77	DUser_InitializeDCompTransforms	Diagnostic
78	DUser_ModifyDCompTransform	Diagnostic
79	DUser_RunDUIPVLAnimationStart	Diagnostic
80	DUser_RunDUIPVLAnimationStop	Diagnostic
81	DUser_AllocateStagingBuffer	Diagnostic
82	DUser_ReleaseStagingBuffer	Diagnostic
83	DUser_LeafNodeOpacity_PossibleLayerPush	Diagnostic
84	DUser_StagingBufferCopy	Diagnostic
85	DUser_Input85	Diagnostic

Event ID 1: DUser_PaintStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Paint
Opcode: Start

Event ID 2: DUser_PaintStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Paint
Opcode: Stop

Event ID 3: DUser_SyncAdaptorsStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_SyncAdaptors
Opcode: Start

Event ID 4: DUser_SyncAdaptorsStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_SyncAdaptors
Opcode: Stop

Fields #

Name	Description
`cAdaptors` Int32

Event ID 5: DUser_ResetInvalidStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ResetInvalid
Opcode: Start

Event ID 6: DUser_ResetInvalidStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ResetInvalid
Opcode: Stop

Event ID 7: DUser_EndDrawBitBltStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_EndDrawBitBlt
Opcode: Start

Event ID 8: DUser_EndDrawBitBltStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_EndDrawBitBlt
Opcode: Stop

Event ID 9: DUser_InputStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Input
Opcode: Start

Event ID 10: DUser_InputStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Input
Opcode: Stop

Event ID 11: DUser_InputStart11

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Input
Opcode: Start

Event ID 12: DUser_LayeredCreateVisualsStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayeredCreateVisuals
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean

Event ID 13: DUser_LayeredRemoveVisualsStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayeredRemoveVisuals
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean
`nWidth` Int32
`nHeight` Int32
`fIsCopy` Boolean

Event ID 14: DUser_LayeredDestructVisualsStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayeredDestructVisuals
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean

Event ID 15: DUser_DestroyPendingDCVisualsStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DestroyPendingDCVisuals
Opcode: Start

Fields #

Name	Description
`nNumberOfPendingDeletions` Int32

Event ID 16: DUser_DestroyPendingDCVisualsStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DestroyPendingDCVisuals
Opcode: Stop

Fields #

Name	Description
`nNumberOfPendingDeletions` Int32

Event ID 17: DUser_ForceDestroyDCVisualStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ForceDestroyDCVisual
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean

Event ID 18: DUser_RemoveAndDestroyDCVisualStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_RemoveAndDestroyDCVisual
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean

Event ID 19: DUser_DrawLayeredGadgetStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DrawLayeredGadget
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean
`nWidth` Int32
`nHeight` Int32
`fIsCopy` Boolean

Event ID 20: DUser_DrawLayeredGadgetStart20

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DrawLayeredGadget
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean
`nWidth` Int32
`nHeight` Int32
`fIsCopy` Boolean

Event ID 21: DUser_LayeredGetBitmapStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayeredGetBitmap
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean
`nWidth` Int32
`nHeight` Int32
`fIsCopy` Boolean

Event ID 22: DUser_LayeredSetContentStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayeredSetContent
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean
`nWidth` Int32
`nHeight` Int32
`fIsCopy` Boolean

Event ID 24: DUser_LayerGadgetStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayerGadget
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32

Event ID 25: DUser_LayerGadgetStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayerGadget
Opcode: Stop

Fields #

Name	Description
`hGadget` UInt32
`fNewLayered` Boolean
`nVisualsCount` Int32

Event ID 26: DUser_LayerGadgetLoopStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayerGadgetLoop
Opcode: Start

Fields #

Name	Description
`cTrans` UInt32
`dwTicket` UInt32

Event ID 27: DUser_LayerGadgetLoopStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayerGadgetLoop
Opcode: Stop

Fields #

Name	Description
`cTrans` UInt32
`dwTicket` UInt32

Event ID 28: DUser_CreateCompatibleBitmapStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_CreateCompatibleBitmap
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`nWidth` Int32
`nHeight` Int32

Event ID 29: DUser_CreateCompatibleBitmapStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_CreateCompatibleBitmap
Opcode: Stop

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`nWidth` Int32
`nHeight` Int32

Event ID 30: DUser_InitPropertiesStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_InitProperties
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`pDCompVisual` Pointer

Event ID 31: DUser_InitPropertiesStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_InitProperties
Opcode: Stop

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`pDCompVisual` Pointer

Event ID 32: DUser_AddChildVisualStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_AddChildVisual
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`pDCompVisual` Pointer

Event ID 33: DUser_AddChildVisualStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_AddChildVisual
Opcode: Stop

Fields #

Name	Description
`hGadget` UInt32
`pChildVisual` Pointer
`fDescendantVisualOfNewVisual` Boolean
`pDCompVisual` Pointer

Event ID 34: DUser_MoveChildrenToParent

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_MoveChildrenToParent

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`m_pParent` Pointer

Event ID 35: DUser_MoveChildrenToParentStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_MoveChildrenToParent
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`pDCompVisual` Pointer

Event ID 36: DUser_MoveChildrenToParentStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_MoveChildrenToParent
Opcode: Stop

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`pDCompVisual` Pointer

Event ID 37: DUser_Reparent

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Reparent

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`pDCompVisual` Pointer

Event ID 38: DUser_ReparentStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Reparent
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`pNewChild` Pointer

Event ID 39: DUser_ReparentStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Reparent
Opcode: Stop

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`pNewChild` Pointer

Event ID 40: DUser_AddWAMTransitionsStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_AddWAMTransitions
Opcode: Start

Fields #

Name	Description
`cTrans` UInt32
`dwTicket` UInt32

Event ID 41: DUser_AddWAMTransitionsStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_AddWAMTransitions
Opcode: Stop

Fields #

Name	Description
`cTrans` UInt32
`dwTicket` UInt32

Event ID 42: DUser_CreateCubicBezierLinearVectorTransition

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_CreateCubicBezierLinearVectorTransition

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`nAnimType` Int32

Event ID 43: DUser_ScheduleWAMStoryboardStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ScheduleWAMStoryboard
Opcode: Start

Fields #

Name	Description
`cTrans` UInt32
`psbUIA` Pointer
`dwTicket` UInt32

Event ID 44: DUser_ScheduleWAMStoryboardStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ScheduleWAMStoryboard
Opcode: Stop

Fields #

Name	Description
`cTrans` UInt32
`psbUIA` Pointer
`dwTicket` UInt32

Event ID 45: DUser_GetCurve

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_GetCurve

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`nVar` Int32

Event ID 46: DUser_DCompCommitStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DCompCommit
Opcode: Start

Fields #

Name	Description
`nSize` Int32

Event ID 47: DUser_DCompCommitStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DCompCommit
Opcode: Stop

Fields #

Name	Description
`nSize` Int32

Event ID 48: DUser_DCompCommit

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DCompCommit

Fields #

Name	Description
`nSize` Int32

Event ID 49: DUser_DrawDirtyLayers

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DrawDirtyLayers

Fields #

Name	Description
`hGadget` UInt32
`m_pVisual` Pointer
`nVisuals` Int32

Event ID 50: DUser_CommitFromWMPaint

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_CommitFromWMPaint

Fields #

Name	Description
`hGadget` UInt32
`m_pVisual` Pointer
`nVisuals` Int32

Event ID 51: DUser_ScheduleTransitionsStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ScheduleTransitions
Opcode: Start

Fields #

Name	Description
`dwTicket` UInt32

Event ID 52: DUser_ScheduleTransitionsStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ScheduleTransitions
Opcode: Stop

Fields #

Name	Description
`dwTicket` UInt32

Event ID 53: DUser_WAMDelayStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_WAMDelay
Opcode: Start

Fields #

Name	Description
`cTrans` UInt32
`psbUIA` Pointer
`dwTicket` UInt32

Event ID 54: DUser_WAMDelayStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_WAMDelay
Opcode: Stop

Fields #

Name	Description
`nVisuals` Int32

Event ID 55: DUser_Input

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Input

Fields #

Name	Description
`PointerID` UInt32

Event ID 56: DUser_TransitionComplete

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_TransitionComplete

Fields #

Name	Description
`hGadget` UInt32
`nCode` UInt32
`fCopy` Boolean
`fRemainLayered` Boolean

Event ID 65: DUser_IntervalAcquireRegionStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_IntervalAcquireRegion
Opcode: Start

Event ID 66: DUser_IntervalAcquireRegionStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_IntervalAcquireRegion
Opcode: Stop

Event ID 67: DUser_IntervalReleaseRegionStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_IntervalReleaseRegion
Opcode: Start

Event ID 68: DUser_IntervalReleaseRegionStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_IntervalReleaseRegion
Opcode: Stop

Event ID 71: DUser_CreateSurface

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_CreateSurface

Fields #

Name	Description
`surfaceId` Pointer
`surfaceX` Int32
`surfaceY` Int32
`surfaceWidth` Int32
`surfaceHeight` Int32
`containerId` Pointer
`containerWidth` Int32
`containerHeight` Int32
`pRegionSurface` Pointer
`pSurface` Pointer

Event ID 72: DUser_DestroySurface

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DestroySurface

Fields #

Name	Description
`pRegionSurface` Pointer
`pSurface` Pointer

Event ID 75: DUser_ProcessPendingStoryboards

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ProcessPendingStoryboards

Fields #

Name	Description
`flProcessingDelay` Float
`nNumberOfStoryboards` Int32
`nNumberOfVisuals` Int32

Event ID 76: DUser_TransitionScheduled

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_TransitionScheduled

Fields #

Name	Description
`cTrans` UInt32
`uTransIndex` UInt32
`dwTicket` UInt32
`hGadget` UInt32
`nProperty` UInt32
`pTransitionVisual` Pointer
`pDCompVisual` Pointer

Event ID 77: DUser_InitializeDCompTransforms

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_InitializeDCompTransforms

Fields #

Name	Description
`nHResult` Int32
`hGadget` UInt32
`fIsCopy` Boolean
`pTransitionVisual` Pointer
`pDCompVisual` Pointer
`pEffectGroup` Pointer

Event ID 78: DUser_ModifyDCompTransform

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ModifyDCompTransform

Fields #

Name	Description
`pTransitionVisual` Pointer
`pDCompVisual` Pointer
`nTransformType` Int32
`pTransform` Pointer
`fAnimation` Boolean

Event ID 79: DUser_RunDUIPVLAnimationStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_RunDUIPVLAnimation
Opcode: Start

Fields #

Name	Description
`pStoryboard` Pointer
`nAnimationId` Int32
`nStoryboardId` Int32
`nCode` Int32
`flProcessingDelay` Float

Event ID 80: DUser_RunDUIPVLAnimationStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_RunDUIPVLAnimation
Opcode: Stop

Fields #

Name	Description
`pStoryboard` Pointer
`nAnimationId` Int32
`nStoryboardId` Int32
`nCode` Int32
`flProcessingDelay` Float

Event ID 81: DUser_AllocateStagingBuffer

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_AllocateStagingBuffer

Fields #

Name	Description
`surfaceId` Pointer
`surfaceX` Int32
`surfaceY` Int32

Event ID 82: DUser_ReleaseStagingBuffer

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ReleaseStagingBuffer

Fields #

Name	Description
`surfaceId` Pointer

Event ID 83: DUser_LeafNodeOpacity_PossibleLayerPush

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LeafNodeOpacity_PossibleLayerPush

Fields #

Name	Description
`hGadget` Pointer
`nWidth` Int32
`nHeight` Int32
`hAncestorGadget` Pointer
`nAncestorWidth` Int32
`nAncestorHeight` Int32

Event ID 84: DUser_StagingBufferCopy

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_StagingBufferCopy

Fields #

Name	Description
`surfaceId` Pointer
`surfaceX` Int32
`surfaceY` Int32
`surfaceWidth` Int32
`surfaceHeight` Int32

Event ID 85: DUser_Input85

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Input

Fields #

Name	Description
`PointerHitTestID` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 8429e243-345b-47c1-8a91-2c94caf0daab

Defined in duser.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Microsoft-Windows-DUSER registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-DUSER registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)