Microsoft-Windows-DXP

30 events across 1 channel

Event	Title	Channel
1	WorkingSetCompositionStart	Analytic
2	WorkingSetCompositionStop	Analytic
3	MetadataAcquisitionStart	Analytic
4	MetadataAcquisitionStop	Analytic
5	SignatureVerificationStart	Analytic
6	SignatureVerificationStop	Analytic
7	DestinationListCreationStart	Analytic
8	DestinationListCreationStop	Analytic
11	AutoPlayLaunchStart	Analytic
12	AutoPlayLaunchStop	Analytic
13	LauncherStart	Analytic
14	LauncherStop	Analytic
15	Launcher	Analytic
16	Launcher16	Analytic
18	LayoutInitialized	Analytic
19	StatusStart	Analytic
20	StatusStop	Analytic
21	Tasks	Analytic
22	DeviceAccessStart	Analytic
23	DeviceAccessStop	Analytic
24	TasksStart	Analytic
25	TasksStop	Analytic
26	SSOStart	Analytic
27	SSOStop	Analytic
28	DeviceConnectStop	Analytic
29	DeviceConnectStop29	Analytic
30	LayoutInitialized30	Analytic
31	LayoutInitializedStart	Analytic
32	LayoutInitializedStop	Analytic
33	LayoutInitialized33	Analytic

Event ID 1: WorkingSetCompositionStart

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: WorkingSetComposition
Opcode: Start

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 2: WorkingSetCompositionStop

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: WorkingSetComposition
Opcode: Stop

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 3: MetadataAcquisitionStart

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: MetadataAcquisition
Opcode: Start

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 4: MetadataAcquisitionStop

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: MetadataAcquisition
Opcode: Stop

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 5: SignatureVerificationStart

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: SignatureVerification
Opcode: Start

Fields #

Name	Description
`FileName` UnicodeString

Event ID 6: SignatureVerificationStop

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: SignatureVerification
Opcode: Stop

Fields #

Name	Description
`FileName` UnicodeString

Event ID 7: DestinationListCreationStart

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: DestinationListCreation
Opcode: Start

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 8: DestinationListCreationStop

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: DestinationListCreation
Opcode: Stop

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 11: AutoPlayLaunchStart

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: AutoPlayLaunch
Opcode: Start

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 12: AutoPlayLaunchStop

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: AutoPlayLaunch
Opcode: Stop

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 13: LauncherStart

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: Launcher
Opcode: Start

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 14: LauncherStop

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: Launcher
Opcode: Stop

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 15: Launcher

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: Launcher

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 16: Launcher16

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: Launcher

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 18: LayoutInitialized

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: LayoutInitialized

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 19: StatusStart

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: Status
Opcode: Start

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 20: StatusStop

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: Status
Opcode: Stop

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 21: Tasks

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: Tasks

Event ID 22: DeviceAccessStart

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: DeviceAccess
Opcode: Start

Event ID 23: DeviceAccessStop

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: DeviceAccess
Opcode: Stop

Event ID 24: TasksStart

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: Tasks
Opcode: Start

Event ID 25: TasksStop

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: Tasks
Opcode: Stop

Event ID 26: SSOStart

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: SSO
Opcode: Start

Event ID 27: SSOStop

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: SSO
Opcode: Stop

Event ID 28: DeviceConnectStop

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: DeviceConnect
Opcode: Stop

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 29: DeviceConnectStop29

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: DeviceConnect
Opcode: Stop

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 30: LayoutInitialized30

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: LayoutInitialized

Event ID 31: LayoutInitializedStart

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: LayoutInitialized
Opcode: Start

Fields #

Name	Description
`Object` UInt64

Event ID 32: LayoutInitializedStop

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: LayoutInitialized
Opcode: Stop

Fields #

Name	Description
`Object` UInt64

Event ID 33: LayoutInitialized33

Provider: Microsoft-Windows-DXP
Channel: Analytic
Task: LayoutInitialized

Fields #

Name	Description
`DeviceID` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 728b8c72-0f0f-4071-9bcc-27cb3b6dacbe

Defined in dxpserver.exe, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Microsoft-Windows-DXP registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-DXP registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)