detection.wiki

Microsoft-Windows-Kernel-Power › Event 566

Event ID 566 — The system session has transitioned from PreviousSessionId to NextSessionId.

Provider
Microsoft-Windows-Kernel-Power
Channel
System
Level
Informational
Task
SystemSessionSwitch

Description

The system session has transitioned from PreviousSessionId to NextSessionId.

Message #

The system session has transitioned from %3 to %10.

Reason %2 

BootId: %1

Fields #

NameDescription
BootId UInt32—
Reason UInt32—
PreviousSessionId UInt64—
PreviousSessionType UInt32—
PreviousSessionDurationInUs UInt64—
PreviousEnergyCapacityAtStart UInt32—
PreviousFullEnergyCapacityAtStart UInt32—
PreviousEnergyCapacityAtEnd UInt32—
PreviousFullEnergyCapacityAtEnd UInt32—
NextSessionId UInt64—
NextSessionType UInt32—
PowerStateAc Boolean—
MonitorReason UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Power",
    "guid": "331C3B3A-2005-44C2-AC5E-77220C37D6B4",
    "event_source_name": "",
    "event_id": 566,
    "version": 0,
    "level": 4,
    "task": 268,
    "opcode": 0,
    "keywords": 9223372036854777348,
    "time_created": "2023-11-06T01:08:04.643524+00:00",
    "event_record_id": 2153,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 9012
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "BootId": 13,
    "Reason": 32,
    "PreviousSessionId": 1,
    "PreviousSessionType": 1,
    "PreviousSessionDurationInUs": 324168323,
    "PreviousEnergyCapacityAtStart": 0,
    "PreviousFullEnergyCapacityAtStart": 0,
    "PreviousEnergyCapacityAtEnd": 0,
    "PreviousFullEnergyCapacityAtEnd": 0,
    "NextSessionId": 3,
    "NextSessionType": 0,
    "PowerStateAc": true,
    "MonitorReason": 32
  },
  "message": ""
}

References #