detection.wiki

Microsoft-Windows-Kernel-General

24 events across 2 channels

Event IDTitleChannel
1The system time has changed to NewTime from OldTime.System
2License policy-cache corruption detected.System
3License policy-cache corruption has been fixed.System
4License policy-cache has expired because it was not updated within expected …System
5{Registry Hive Recovered} Registry hive (file): 'ExtraString' was corrupted and …System
6An I/O operation initiated by the Registry failed unrecoverably.System
7The system failed to open transaction log {LogFile} for hive {HivePath}.System
11TxR init phase for hive ExtraString (TM: TmId, RM: RmId) finished with …System
12The operating system started at system time StartTime.System
13The operating system is shutting down at system time StopTime.System
14Operational
15Hive HiveName was reorganized with a starting size of OriginalSize bytes and an …System
16The access history in hive HiveName was cleared updating KeysUpdated keys and …System
17Operational
18The operating system is starting after soft restart.System
19Operational
20The leap second configuration has been updated.System
21Failed to update leap second data from the registry.System
22The time zone bias has changed to NewBias from OldBias.System
23Operational
24The time zone information was refreshed with exit reason ExitReason.System
25The system time was initialized to SystemTime.System
26Operational
26Token information was queried for TokenIsAppContainer.System

Event ID 1 — The system time has changed to NewTime from OldTime.

#
Provider
Microsoft-Windows-Kernel-General
Channel
System
Level
Informational
Collection Priority
Recommended (NSA)
Task
SystemTimeChange

Description

The system time has changed to NewTime from OldTime.

Message #

The system time has changed to %1 from %2.

Fields #

NameDescription
NewTime FILETIME—
OldTime FILETIME—
TimeDeltaInMs Int64Time Delta.
Reason UInt32Change Reason.
ProcessName UnicodeString—
ProcessID UInt32—
CmosTime FILETIMERTC time.
TimeZoneBias Int32Current time zone bias.
RealTimeIsUniversal BooleanRTC time is in UTC.
SystemInCmosMode BooleanSystem time was based on RTC time.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D",
    "event_source_name": "",
    "event_id": 1,
    "version": 4,
    "level": 4,
    "task": 5,
    "opcode": 0,
    "keywords": 9223372036854775824,
    "time_created": "2023-11-05T22:32:22.236350+00:00",
    "event_record_id": 1943,
    "correlation": {},
    "execution": {
      "process_id": 3308,
      "thread_id": 3676
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NewTime": "2023-11-05T22:32:22.232000Z",
    "OldTime": "2023-11-05T22:32:20.942615Z",
    "TimeDeltaInMs": 1289,
    "Reason": 1,
    "ProcessName": "\\Device\\HarddiskVolume4\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe",
    "ProcessID": 3308,
    "CmosTime": "2023-11-05T14:32:22.232000Z",
    "TimeZoneBias": 480,
    "RealTimeIsUniversal": false,
    "SystemInCmosMode": false
  },
  "message": ""
}

References #

Event ID 2 — License policy-cache corruption detected.

Provider
Microsoft-Windows-Kernel-General
Channel
System
Opcode
Info

Description

License policy-cache corruption detected.

Message #

License policy-cache corruption detected.

Event ID 3 — License policy-cache corruption has been fixed.

Provider
Microsoft-Windows-Kernel-General
Channel
System
Opcode
Info

Description

License policy-cache corruption has been fixed.

Message #

License policy-cache corruption has been fixed.

Event ID 4 — License policy-cache has expired because it was not updated within expected duration.

Provider
Microsoft-Windows-Kernel-General
Channel
System
Opcode
Info

Description

License policy-cache has expired because it was not updated within expected duration.

Message #

License policy-cache has expired because it was not updated within expected duration.

Event ID 5 — {Registry Hive Recovered} Registry hive (file): 'ExtraString' was corrupted and it has been recovered.

Provider
Microsoft-Windows-Kernel-General
Channel
System
Opcode
Info

Description

{Registry Hive Recovered} Registry hive (file): 'ExtraString' was corrupted and it has been recovered. Some data might have been lost.

Message #

{Registry Hive Recovered} Registry hive (file): '%3' was corrupted and it has been recovered. Some data might have been lost.

Fields #

NameDescription
FinalStatus HexInt32—
ExtraStringLength UInt16—
ExtraString UnicodeString—

Event ID 6 — An I/O operation initiated by the Registry failed unrecoverably.

Provider
Microsoft-Windows-Kernel-General
Channel
System
Opcode
Info

Description

An I/O operation initiated by the Registry failed unrecoverably.The Registry could not flush hive (file): 'ExtraString'.

Message #

An I/O operation initiated by the Registry failed unrecoverably.The Registry could not flush hive (file): '%3'.

Fields #

NameDescription
FinalStatus HexInt32—
ExtraStringLength UInt16—
ExtraString UnicodeString—

Event ID 7 — The system failed to open transaction log {LogFile} for hive {HivePath}.

Provider
Microsoft-Windows-Kernel-General
Channel
System

Message #

The system failed to open transaction log {LogFile} for hive {HivePath}. Some transactional consistency might have been lost. (Failure status {Status}; TM: {TmId}; RM: {RmId}; InternalCode: {InternalCode})

Fields #

NameDescription
LogFile—
HivePath—
Status— NTSTATUS reference
TmId—
RmId—
InternalCode—

Event ID 11 — TxR init phase for hive ExtraString (TM: TmId, RM: RmId) finished with result=Status (Internal code=InternalCode).

Provider
Microsoft-Windows-Kernel-General
Channel
System
Level
Informational
Opcode
Info

Description

TxR init phase for hive ExtraString (TM: TmId, RM: RmId) finished with result=Status (Internal code=InternalCode).

Message #

TxR init phase for hive %2 (TM: %3, RM: %4) finished with result=%5 (Internal code=%6).

Fields #

NameDescription
ExtraStringLength UInt16—
ExtraString UnicodeString—
TmId GUID—
RmId GUID—
Status HexInt32— NTSTATUS reference
InternalCode UInt32—
RM—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D",
    "event_source_name": "",
    "event_id": 11,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-09T02:31:13.021540+00:00",
    "event_record_id": 2588,
    "correlation": {},
    "execution": {
      "process_id": 4888,
      "thread_id": 1608
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ExtraStringLength": 79,
    "ExtraString": "\\??\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy2\\Windows\\System32\\config\\DRIVERS",
    "TmId": "465845D7-1B56-11F1-9FBF-C6B26F270F0B",
    "RmId": "465845D6-1B56-11F1-9FBF-C6B26F270F0B",
    "Status": "0xc00000a2",
    "InternalCode": 7
  },
  "message": ""
}

Event ID 12 — The operating system started at system time StartTime.

#
Provider
Microsoft-Windows-Kernel-General
Channel
System
Level
Informational
Collection Priority
Recommended (Microsoft-WEF, others)
Task
SystemStart

Description

The operating system started at system time StartTime.

Message #

The operating system started at system time %7.

Fields #

NameDescription
MajorVersion UInt32—
MinorVersion UInt32—
BuildVersion UInt32—
QfeVersion UInt32—
ServiceVersion UInt16—
BootMode UInt32—
StartTime FILETIME—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D",
    "event_source_name": "",
    "event_id": 12,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2023-11-06T06:24:56.248018+00:00",
    "event_record_id": 1624,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "MajorVersion": 10,
    "MinorVersion": 0,
    "BuildVersion": 22621,
    "QfeVersion": 2428,
    "ServiceVersion": 0,
    "BootMode": 0,
    "StartTime": "2023-11-06T06:24:49.500000Z"
  },
  "message": ""
}

References #

Event ID 13 — The operating system is shutting down at system time StopTime.

#
Provider
Microsoft-Windows-Kernel-General
Channel
System
Level
Informational
Collection Priority
Recommended (Microsoft-WEF, others)
Task
SystemStop

Description

The operating system is shutting down at system time StopTime.

Message #

The operating system is shutting down at system time %1.

Fields #

NameDescription
StopTime FILETIME—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D",
    "event_source_name": "",
    "event_id": 13,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2023-11-06T06:23:42.448179+00:00",
    "event_record_id": 1623,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 388
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "StopTime": "2023-11-06T06:23:42.448171Z"
  },
  "message": ""
}

References #

Event ID 14 —

Provider
Microsoft-Windows-Kernel-General
Channel
Operational
Opcode
Info

Fields #

NameDescription
Mode UnicodeString—
ObjectType UnicodeString—
ObjectName UnicodeString—
ProcessName UnicodeString—
ObjectCreatorProcessName UnicodeString—
AccessMask HexInt32— Access mask reference
TokenType UInt32—
ImpersonationLevel UInt32—
Known values
%%1831
Anonymous
%%1832
Identification
%%1833
Impersonation
%%1840
Delegation
SessionId UInt32—
LowBoxNumber UInt32—
TokenGroupsCount UInt32—
TokenGroups 28—
TokenPackageCount UInt32—
TokenPackage 30—
TokenCapabilityCount UInt32—
TokenCapabilities 31—
TokenTrustLevelCount UInt32—
TokenTrustLevel 33—
SecurityDescriptorRevision UInt8—
SecurityDescriptorControl UInt16—
SecurityDescriptorOwner SID—
SecurityDescriptorGroup SID—
DaclRevision UInt8—
DaclAceCount UInt16—
DaclAce 34—
SaclRevision UInt8—
SaclAceCount UInt16—
SaclAce 38—

Event ID 15 — Hive HiveName was reorganized with a starting size of OriginalSize bytes and an ending size of NewSize bytes.

#
Provider
Microsoft-Windows-Kernel-General
Channel
System
Level
Informational
Task
ReorganizeHive

Description

Hive HiveName was reorganized with a starting size of OriginalSize bytes and an ending size of NewSize bytes.

Message #

Hive %2 was reorganized with a starting size of %3 bytes and an ending size of %4 bytes.

Fields #

NameDescription
HiveNameLength UInt16—
HiveName UnicodeString—
OriginalSize UInt32—
NewSize UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T06:23:38.372509+00:00",
    "event_record_id": 1618,
    "correlation": {},
    "execution": {
      "process_id": 1416,
      "thread_id": 1420
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HiveNameLength": 52,
    "HiveName": "\\??\\C:\\Windows\\System32\\SMI\\Store\\Machine\\SCHEMA.DAT",
    "OriginalSize": 11767808,
    "NewSize": 10665984
  },
  "message": ""
}

References #

Event ID 16 — The access history in hive HiveName was cleared updating KeysUpdated keys and creating DirtyPages modified pages.

#
Provider
Microsoft-Windows-Kernel-General
Channel
System
Level
Informational
Opcode
Info

Description

The access history in hive HiveName was cleared updating KeysUpdated keys and creating DirtyPages modified pages.

Message #

The access history in hive %2 was cleared updating %3 keys and creating %4 modified pages.

Fields #

NameDescription
HiveNameLength UInt16—
HiveName UnicodeString—
KeysUpdated UInt32—
DirtyPages UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D",
    "event_source_name": "",
    "event_id": 16,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T06:25:49.389450+00:00",
    "event_record_id": 1705,
    "correlation": {},
    "execution": {
      "process_id": 3584,
      "thread_id": 3588
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HiveNameLength": 85,
    "HiveName": "\\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat",
    "KeysUpdated": 0,
    "DirtyPages": 0
  },
  "message": ""
}

Detection Rules #

View all rules referencing this event →

Sigma # view in reference

  • Critical Hive In Suspicious Location Access Bits Cleared source high: Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset. This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default). Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.

References #

Event ID 17 —

Provider
Microsoft-Windows-Kernel-General
Channel
Operational
Opcode
Info

Fields #

NameDescription
ActionName UnicodeString—
ProcessName UnicodeString—
AccountName UnicodeString—
AuthorityName UnicodeString—
TokenId HexInt64—
AuthenticationId HexInt64—
TokenType UInt32—
ImpersonationLevel UInt32—
Known values
%%1831
Anonymous
%%1832
Identification
%%1833
Impersonation
%%1840
Delegation
TokenFlags HexInt32—
SidValuesReferenceCount Int64—
SidValuesCount UInt32—
SidValues GUID—
SharedSidValuesReferenceCount Int64—
SharedSidValuesCount UInt32—
SharedSidValues Pointer—

Event ID 18 — The operating system is starting after soft restart.

Provider
Microsoft-Windows-Kernel-General
Channel
System
Task
SoftBootInfo

Description

The operating system is starting after soft restart.

Message #

The operating system is starting after soft restart.

Fields #

NameDescription
TransitionStartTime FILETIME—
CurrentTime FILETIME—
SoftRestartCount UInt32—
BugcheckRecovery Boolean—

Event ID 19 —

Provider
Microsoft-Windows-Kernel-General
Channel
Operational
Task
BootPerformanceData

Fields #

NameDescription
MmPhase0Start UInt64—
MmPhase0Stop UInt64—
Phase1Start UInt64—
KsrExtensionStart UInt64—
KsrExtensionStop UInt64—
StartProcessorsStart UInt64—
StartProcessorsStop UInt64—
AutoLoggerInitStart UInt64—
AutoLoggerInitStop UInt64—
MmPhase1Start UInt64—
MmPhase1Stop UInt64—
HalPhase0StartCycleTime UInt64—
HalPhase0StopCycleTime UInt64—
MmMark UInt64—

Event ID 20 — The leap second configuration has been updated.

#
Provider
Microsoft-Windows-Kernel-General
Channel
System
Level
Informational
Task
LeapSecondDataUpdate

Description

The leap second configuration has been updated.

Message #

The leap second configuration has been updated.
Reason: %1
Leap seconds enabled: %2
New leap second count: %3
Old leap second count: %4

Fields #

NameDescription
UpdateReason UInt32Reason.
EnabledNew BooleanLeap seconds enabled.
CountNew UInt32New leap second count.
CountOld UInt32Old leap second count.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D",
    "event_source_name": "",
    "event_id": 20,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 0,
    "keywords": 9223372036854775824,
    "time_created": "2023-11-06T06:24:56.378127+00:00",
    "event_record_id": 1634,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "UpdateReason": 0,
    "EnabledNew": true,
    "CountNew": 0,
    "CountOld": 0
  },
  "message": ""
}

References #

Event ID 21 — Failed to update leap second data from the registry.

Provider
Microsoft-Windows-Kernel-General
Channel
System
Task
LeapSecondDataParseFailure

Description

Failed to update leap second data from the registry. Reason: FailureResult.

Message #

Failed to update leap second data from the registry. Reason: %1

Fields #

NameDescription
FailureResult UInt32—

Event ID 22 — The time zone bias has changed to NewBias from OldBias.

#
Provider
Microsoft-Windows-Kernel-General
Channel
System
Level
Informational
Task
TimeZoneBiasChange

Description

The time zone bias has changed to NewBias from OldBias.

Message #

The time zone bias has changed to %1 from %2.

Fields #

NameDescription
NewBias Int32—
OldBias Int32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D",
    "event_source_name": "",
    "event_id": 22,
    "version": 0,
    "level": 4,
    "task": 8,
    "opcode": 0,
    "keywords": 9223372036854775824,
    "time_created": "2022-04-04T07:40:07.884201+00:00",
    "event_record_id": 719,
    "correlation": {},
    "execution": {
      "process_id": 1080,
      "thread_id": 1208
    },
    "channel": "System",
    "computer": "WIN-TKC15D7KHUR",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NewBias": 420,
    "OldBias": 480
  },
  "message": ""
}

References #

Event ID 23 —

Provider
Microsoft-Windows-Kernel-General
Channel
Operational
Task
VsmPerformanceData

Fields #

NameDescription
VsmCleanupTime UInt64—
Mark0 UInt64—
Mark1 UInt64—
Mark2 UInt64—
Mark3 UInt64—
Mark4 UInt64—
Mark5 UInt64—
Mark6 UInt64—
Mark7 UInt64—
VsmCleanupTimeFrequency UInt64—

Event ID 24 — The time zone information was refreshed with exit reason ExitReason.

#
Provider
Microsoft-Windows-Kernel-General
Channel
System
Level
Informational
Task
TimeZoneInformationRefresh

Description

The time zone information was refreshed with exit reason ExitReason. Current time zone bias is CurrentBias.

Message #

The time zone information was refreshed with exit reason %1. Current time zone bias is %2.

Fields #

NameDescription
ExitReason UInt32—
CurrentBias Int32—
CurrentTimeZoneID UInt32—
TimeZoneInfoCacheUpdated UInt8—
FirstRefresh UInt8—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D",
    "event_source_name": "",
    "event_id": 24,
    "version": 0,
    "level": 4,
    "task": 11,
    "opcode": 0,
    "keywords": 9223372036854775824,
    "time_created": "2023-11-06T06:25:25.525777+00:00",
    "event_record_id": 1652,
    "correlation": {},
    "execution": {
      "process_id": 100,
      "thread_id": 520
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ExitReason": 0,
    "CurrentBias": 480,
    "CurrentTimeZoneID": 1,
    "TimeZoneInfoCacheUpdated": 0,
    "FirstRefresh": 0
  },
  "message": ""
}

References #

Event ID 25 — The system time was initialized to SystemTime.

Provider
Microsoft-Windows-Kernel-General
Channel
System
Task
BootSystemTime

Description

The system time was initialized to SystemTime.

Message #

The system time was initialized to %1. 

Loader time: %2
Internal boot flags: %3
HAL RTC error code: %4
RTC time is in UTC: %5
Soft boot: %6
Success: %7
Phase: %8

Fields #

NameDescription
SystemTime FILETIME—
LoaderTime FILETIME—
InternalBootFlags UInt64—
HalRtcErrorCode UInt32—
RealTimeIsUniversal Boolean—
IsSoftBoot Boolean—
Success Boolean—
Phase UInt32—

Event ID 26 —

Provider
Microsoft-Windows-Kernel-General
Channel
Operational

Description

Token information was queried for TokenIsAppContainer.

Fields #

NameDescription
ProcessName UnicodeString—
PackageSid SID—

Event ID 26 — Token information was queried for TokenIsAppContainer.

Provider
Microsoft-Windows-Kernel-General
Channel
System

Description

Token information was queried for TokenIsAppContainer.

Message #

Token information was queried for TokenIsAppContainer.

Fields #

NameDescription
ProcessName UnicodeString—
PackageSid SID—