Microsoft-Windows-Kernel-Registry

45 events across 2 channels

Event	Title	Channel
1	task_0CreateKey	Analytic
2	task_0OpenKey	Analytic
3	task_0DeleteKey	Analytic
4	task_0QueryKey	Analytic
5	task_0SetValueKey	Analytic
6	task_0DeleteValueKey	Analytic
7	task_0QueryValueKey	Analytic
8	task_0EnumerateKey	Analytic
9	task_0EnumerateValueKey	Analytic
10	task_0QueryMultipleValueKey	Analytic
11	task_0SetInformationKey	Analytic
12	task_0FlushKey	Analytic
13	task_0CloseKey	Analytic
14	task_0QuerySecurityKey	Analytic
15	task_0SetSecurityKey	Analytic
16	Thisgroupofeventstrackstheperformanceofmountinghivesfromexistingfiles.Start	Performance
17	This group of events tracks the performance of mounting hives from existing …	Performance
18	This group of events tracks the performance of mounting hives from existing …	Performance
19	This group of events tracks the performance of mounting hives from existing …	Performance
20	This group of events tracks the performance of unloading hives.	Performance
21	This group of events tracks the performance of unloading hives.	Performance
22	This group of events tracks the performance of flushing hives.	Performance
23	Thisgroupofeventstrackstheperformanceofflushinghives.RegPerfOpHiveFlushBecameAct …	Performance
24	This group of events tracks the performance of flushing hives.	Performance
25	This group of events tracks the performance of flushing hives.	Performance
26	This group of events tracks the performance of flushing hives.	Performance
27	This group of events tracks the performance of flushing hives.	Performance
28	Thisgroupofeventstrackstheperformanceofflushinghives.RegPerfOpHiveFlushBoostedAc …	Performance
29	Thisgroupofeventstrackstheperformanceofflushinghives.RegPerfOpHiveFlushStartWait …	Performance
30	Thisgroupofeventstrackstheperformanceofflushinghives.RegPerfOpHiveFlushFinishWai …	Performance
31	This group of events tracks the performance of flushing hives.	Performance
32	Thisgroupofeventstrackstheperformanceofregistryshutdown.Start	Performance
33	Thisgroupofeventstrackstheperformanceofregistryshutdown.Start33	Performance
34	Thisgroupofeventstrackstheperformanceofregistryshutdown.RegPerfOpShutdownFlushSt …	Performance
35	Thisgroupofeventstrackstheperformanceofregistryshutdown.RegPerfOpShutdownFlushSt …	Performance
36	Thisgroupofeventstrackstheperformanceofregistryshutdown.Stop	Performance
37	This group of events tracks the performance of loading hives.	Performance
38	This group of events tracks the performance of loading hives.	Performance
39	This group of events tracks the performance of restoring hives.	Performance
40	This group of events tracks the performance of restoring hives.	Performance
41	This group of events tracks the performance of exporting hives.	Performance
42	Thisgroupofeventstrackstheperformanceofexportinghives.RegPerfOpSaveFileCopied	Performance
43	Thisgroupofeventstrackstheperformanceofexportinghives.RegPerfOpSaveTreeCopied	Performance
44	Thisgroupofeventstrackstheperformanceofexportinghives.RegPerfOpSaveFileWritten	Performance
45	This group of events tracks the performance of exporting hives.	Performance

Event ID 1: task_0CreateKey

Provider: Microsoft-Windows-Kernel-Registry
Channel: Analytic
Also via: realtime ETW trace
Level: Error
Opcode: CreateKey

Fields #

Name	Description
`BaseObject` Pointer
`KeyObject` Pointer
`Status` UInt32	NTSTATUS reference
`Disposition` UInt32
`BaseName` UnicodeString
`RelativeName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "1",
    "version": "0",
    "level": "2",
    "task": "0",
    "opcode": "32",
    "keywords": 9223372036854779904,
    "time_created": "2026-03-16T00:21:35.785504900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "9144",
      "thread_id": "1104"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BaseObject": "0xFFFF810C5DD6DD50",
    "KeyObject": "0xFFFF810C5DD72260",
    "Status": "0x0",
    "Disposition": "       2",
    "BaseName": "",
    "RelativeName": "Software\\Microsoft\\WBEM\\CIMOM"
  },
  "message": ""
}

Event ID 2: task_0OpenKey

Provider: Microsoft-Windows-Kernel-Registry
Channel: Analytic
Also via: realtime ETW trace
Level: Error
Opcode: OpenKey

Fields #

Name	Description
`BaseObject` Pointer
`KeyObject` Pointer
`Status` UInt32	NTSTATUS reference
`Disposition` UInt32
`BaseName` UnicodeString
`RelativeName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "2",
    "version": "0",
    "level": "2",
    "task": "0",
    "opcode": "33",
    "keywords": 9223372036854784000,
    "time_created": "2026-03-16T00:21:35.507079800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "1032",
      "thread_id": "12928"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BaseObject": "0xFFFF810C2A657DB0",
    "KeyObject": "0xFFFF810C5DD71F30",
    "Status": "0x0",
    "Disposition": "       0",
    "BaseName": "",
    "RelativeName": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize"
  },
  "message": ""
}

Event ID 3: task_0DeleteKey

Provider: Microsoft-Windows-Kernel-Registry
Channel: Analytic
Also via: realtime ETW trace
Level: Error
Opcode: DeleteKey

Fields #

Name	Description
`KeyObject` Pointer
`Status` UInt32	NTSTATUS reference
`KeyName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "3",
    "version": "0",
    "level": "2",
    "task": "0",
    "opcode": "34",
    "keywords": 9223372036854792192,
    "time_created": "2026-03-16T00:21:57.097838200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "9060",
      "thread_id": "12368"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "KeyObject": "0xFFFF810C4E440E30",
    "Status": "0x0",
    "KeyName": ""
  },
  "message": ""
}

Event ID 4: task_0QueryKey

Provider: Microsoft-Windows-Kernel-Registry
Channel: Analytic
Also via: realtime ETW trace
Level: Error
Opcode: QueryKey

Fields #

Name	Description
`KeyObject` Pointer
`Status` UInt32	NTSTATUS reference
`InfoClass` UInt32
`DataSize` UInt32
`KeyName` UnicodeString
`CapturedDataSize` UInt16
`CapturedData` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "4",
    "version": "0",
    "level": "2",
    "task": "0",
    "opcode": "35",
    "keywords": 9223372036854808576,
    "time_created": "2026-03-16T00:21:35.516631000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "9772",
      "thread_id": "4452"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "KeyObject": "0xFFFF810C31D05F00",
    "Status": "0x0",
    "InfoClass": "       7",
    "DataSize": "       4",
    "KeyName": "",
    "CapturedDataSize": "0",
    "CapturedData": ""
  },
  "message": ""
}

Event ID 5: task_0SetValueKey

Provider: Microsoft-Windows-Kernel-Registry
Channel: Analytic
Also via: realtime ETW trace
Level: Error
Opcode: SetValueKey

Fields #

Name	Description
`KeyObject` Pointer
`Status` UInt32	NTSTATUS reference
`Type` UInt32
`DataSize` UInt32
`KeyName` UnicodeString
`ValueName` UnicodeString
`CapturedDataSize` UInt16
`CapturedData` Binary
`PreviousDataType` UInt32
`PreviousDataSize` UInt32
`PreviousDataCapturedSize` UInt16
`PreviousData` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "5",
    "version": "0",
    "level": "2",
    "task": "0",
    "opcode": "36",
    "keywords": 9223372036854776064,
    "time_created": "2026-03-16T00:21:40.590478500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "3688",
      "thread_id": "7552"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "KeyObject": "0xFFFF810C5DD4DC20",
    "Status": "0x0",
    "Type": "      11",
    "DataSize": "       8",
    "KeyName": "",
    "ValueName": "LastSuccessfulUploadTime",
    "CapturedDataSize": "0",
    "CapturedData": "",
    "PreviousDataType": "       0",
    "PreviousDataSize": "       0",
    "PreviousDataCapturedSize": "0",
    "PreviousData": ""
  },
  "message": ""
}

Event ID 6: task_0DeleteValueKey

Provider: Microsoft-Windows-Kernel-Registry
Channel: Analytic
Also via: realtime ETW trace
Level: Critical
Opcode: DeleteValueKey

Fields #

Name	Description
`KeyObject` Pointer
`Status` UInt32	NTSTATUS reference
`KeyName` UnicodeString
`ValueName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "6",
    "version": "0",
    "level": "1",
    "task": "0",
    "opcode": "37",
    "keywords": 9223372036854776320,
    "time_created": "2026-03-16T00:22:34.277328900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "3668",
      "thread_id": "7712"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "KeyObject": "0xFFFF810C42CA9410",
    "Status": "0xC0000034",
    "KeyName": "",
    "ValueName": "97eb03fb6ad64051d2fd3a6dc2ad7390"
  },
  "message": ""
}

Event ID 7: task_0QueryValueKey

Provider: Microsoft-Windows-Kernel-Registry
Channel: Analytic
Also via: realtime ETW trace
Level: Critical
Opcode: QueryValueKey

Fields #

Name	Description
`KeyObject` Pointer
`Status` UInt32	NTSTATUS reference
`InfoClass` UInt32
`DataSize` UInt32
`KeyName` UnicodeString
`ValueName` UnicodeString
`CapturedDataSize` UInt16
`CapturedData` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "7",
    "version": "0",
    "level": "1",
    "task": "0",
    "opcode": "38",
    "keywords": 9223372036854776832,
    "time_created": "2026-03-16T00:21:35.507114200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "1032",
      "thread_id": "12928"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "KeyObject": "0xFFFF810C5DD71F30",
    "Status": "0xC0000034",
    "InfoClass": "       2",
    "DataSize": "       2",
    "KeyName": "",
    "ValueName": "DisableMetaFiles",
    "CapturedDataSize": "0",
    "CapturedData": ""
  },
  "message": ""
}

Event ID 8: task_0EnumerateKey

Provider: Microsoft-Windows-Kernel-Registry
Channel: Analytic
Also via: realtime ETW trace
Level: Error
Opcode: EnumerateKey

Fields #

Name	Description
`KeyObject` Pointer
`Status` UInt32	NTSTATUS reference
`Index` UInt32
`InfoClass` UInt32
`DataSize` UInt32
`KeyName` UnicodeString
`CapturedDataSize` UInt16
`CapturedData` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "8",
    "version": "0",
    "level": "2",
    "task": "0",
    "opcode": "39",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-16T00:21:35.816738500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "9144",
      "thread_id": "1104"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "KeyObject": "0xFFFF810C33B2F6C0",
    "Status": "0x0",
    "Index": "       0",
    "InfoClass": "       0",
    "DataSize": "      92",
    "KeyName": "",
    "CapturedDataSize": "0",
    "CapturedData": ""
  },
  "message": ""
}

Event ID 9: task_0EnumerateValueKey

Provider: Microsoft-Windows-Kernel-Registry
Channel: Analytic
Also via: realtime ETW trace
Level: Error
Opcode: EnumerateValueKey

Fields #

Name	Description
`KeyObject` Pointer
`Status` UInt32	NTSTATUS reference
`Index` UInt32
`InfoClass` UInt32
`DataSize` UInt32
`KeyName` UnicodeString
`CapturedDataSize` UInt16
`CapturedData` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "9",
    "version": "0",
    "level": "2",
    "task": "0",
    "opcode": "40",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-16T00:21:35.527894500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10736",
      "thread_id": "11352"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "KeyObject": "0xFFFF810C5DD54550",
    "Status": "0x0",
    "Index": "       0",
    "InfoClass": "       2",
    "DataSize": "      36",
    "KeyName": "",
    "CapturedDataSize": "0",
    "CapturedData": ""
  },
  "message": ""
}

Event ID 10: task_0QueryMultipleValueKey

Provider: Microsoft-Windows-Kernel-Registry
Channel: Analytic
Also via: realtime ETW trace
Level: Error
Opcode: QueryMultipleValueKey

Fields #

Name	Description
`KeyObject` Pointer
`Status` UInt32	NTSTATUS reference
`EntryCount` UInt32
`DataSize` UInt32
`KeyName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "10",
    "version": "0",
    "level": "2",
    "task": "0",
    "opcode": "41",
    "keywords": 9223372036854775840,
    "time_created": "2026-03-16T00:21:35.626480500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "5012",
      "thread_id": "3304"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "KeyObject": "0xFFFF810C5DD6DA20",
    "Status": "0x0",
    "EntryCount": "      30",
    "DataSize": "     264",
    "KeyName": ""
  },
  "message": ""
}

Event ID 11: task_0SetInformationKey

Provider: Microsoft-Windows-Kernel-Registry
Channel: Analytic
Also via: realtime ETW trace
Level: Error
Opcode: SetInformationKey

Fields #

Name	Description
`KeyObject` Pointer
`Status` UInt32	NTSTATUS reference
`InfoClass` UInt32
`DataSize` UInt32
`KeyName` UnicodeString
`CapturedDataSize` UInt16
`CapturedData` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "11",
    "version": "0",
    "level": "2",
    "task": "0",
    "opcode": "42",
    "keywords": 9223372036854775872,
    "time_created": "2026-03-16T00:21:35.634196200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "5012",
      "thread_id": "3304"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "KeyObject": "0xFFFF810C5DD6E080",
    "Status": "0x0",
    "InfoClass": "       5",
    "DataSize": "       4",
    "KeyName": "",
    "CapturedDataSize": "0",
    "CapturedData": ""
  },
  "message": ""
}

Event ID 12: task_0FlushKey

Provider: Microsoft-Windows-Kernel-Registry
Channel: Analytic
Opcode: FlushKey

Fields #

Name	Description
`KeyObject` Pointer
`Status` UInt32	NTSTATUS reference
`KeyName` UnicodeString

Event ID 13: task_0CloseKey

Provider: Microsoft-Windows-Kernel-Registry
Channel: Analytic
Also via: realtime ETW trace
Level: Error
Opcode: CloseKey

Fields #

Name	Description
`KeyObject` Pointer
`Status` UInt32	NTSTATUS reference
`KeyName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "13",
    "version": "0",
    "level": "2",
    "task": "0",
    "opcode": "44",
    "keywords": 9223372036854775809,
    "time_created": "2026-03-16T00:21:35.505174000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "1032",
      "thread_id": "12928"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "KeyObject": "0xFFFF810C35F58620",
    "Status": "0x0",
    "KeyName": ""
  },
  "message": ""
}

Event ID 14: task_0QuerySecurityKey

Provider: Microsoft-Windows-Kernel-Registry
Channel: Analytic
Also via: realtime ETW trace
Level: Error
Opcode: QuerySecurityKey

Fields #

Name	Description
`KeyObject` Pointer
`Status` UInt32	NTSTATUS reference
`KeyName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "14",
    "version": "0",
    "level": "2",
    "task": "0",
    "opcode": "45",
    "keywords": 9223372036854775810,
    "time_created": "2026-03-16T00:21:57.923947000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "9060",
      "thread_id": "12368"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "KeyObject": "0xFFFF810C5DD62140",
    "Status": "0x0",
    "KeyName": ""
  },
  "message": ""
}

Event ID 15: task_0SetSecurityKey

Provider: Microsoft-Windows-Kernel-Registry
Channel: Analytic
Also via: realtime ETW trace
Level: Error
Opcode: SetSecurityKey

Fields #

Name	Description
`KeyObject` Pointer
`Status` UInt32	NTSTATUS reference
`KeyName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "15",
    "version": "0",
    "level": "2",
    "task": "0",
    "opcode": "46",
    "keywords": 9223372036854775812,
    "time_created": "2026-03-16T00:24:09.957774700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "6472",
      "thread_id": "10124"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "KeyObject": "0xFFFF810C5DD61260",
    "Status": "0x0",
    "KeyName": ""
  },
  "message": ""
}

Event ID 16: Thisgroupofeventstrackstheperformanceofmountinghivesfromexistingfiles.Start

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Level: Informational
Task: Thisgroupofeventstrackstheperformanceofmountinghivesfromexistingfiles.
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "16",
    "version": "0",
    "level": "4",
    "task": "1",
    "opcode": "1",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-16T00:23:58.966769000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "4",
      "thread_id": "7308"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Performance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 17: This group of events tracks the performance of mounting hives from existing files.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Level: Informational
Task: Thisgroupofeventstrackstheperformanceofmountinghivesfromexistingfiles.
Opcode: RegPerfOpHiveMountBaseFileMounted

Fields #

Name	Description
`HiveFilePath` UnicodeString
`FileSize` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "17",
    "version": "0",
    "level": "4",
    "task": "1",
    "opcode": "10",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-16T00:23:59.073398500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "4",
      "thread_id": "7308"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Performance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "HiveFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\config\\DRIVERS",
    "FileSize": " 4648960"
  },
  "message": ""
}

Event ID 18: This group of events tracks the performance of mounting hives from existing files.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofmountinghivesfromexistingfiles.
Opcode: RegPerfOpHiveMountLogEntryApplied

Fields #

Name	Description
`TotalEntrySize` UInt32
`BytesRecovered` UInt32

Event ID 19: This group of events tracks the performance of mounting hives from existing files.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Level: Informational
Task: Thisgroupofeventstrackstheperformanceofmountinghivesfromexistingfiles.
Opcode: Stop

Fields #

Name	Description
`StatusCode` HexInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "19",
    "version": "0",
    "level": "4",
    "task": "1",
    "opcode": "2",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-16T00:23:59.074329800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "4",
      "thread_id": "7308"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Performance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "StatusCode": "0x0"
  },
  "message": ""
}

Event ID 20: This group of events tracks the performance of unloading hives.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofunloadinghives.
Opcode: Start

Fields #

Name	Description
`HiveFilePath` UnicodeString
`HiveMountPoint` UnicodeString

Event ID 21: This group of events tracks the performance of unloading hives.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofunloadinghives.
Opcode: Stop

Fields #

Name	Description
`StatusCode` HexInt32	NTSTATUS reference

Event ID 22: This group of events tracks the performance of flushing hives.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Level: Informational
Task: Thisgroupofeventstrackstheperformanceofflushinghives.
Opcode: Start

Fields #

Name	Description
`HiveFilePath` UnicodeString
`HiveMountPoint` UnicodeString
`FlushFlags` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "22",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "1",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-16T00:21:56.773417700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "240",
      "thread_id": "928"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Performance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "HiveFilePath": "\\SystemRoot\\System32\\Config\\SOFTWARE",
    "HiveMountPoint": "\\REGISTRY\\MACHINE\\SOFTWARE",
    "FlushFlags": "0x12"
  },
  "message": ""
}

Event ID 23: Thisgroupofeventstrackstheperformanceofflushinghives.RegPerfOpHiveFlushBecameActiveFlusher

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofflushinghives.
Opcode: RegPerfOpHiveFlushBecameActiveFlusher

Event ID 24: This group of events tracks the performance of flushing hives.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofflushinghives.
Opcode: RegPerfOpHiveFlushGatheredLogData

Fields #

Name	Description
`BytesGathered` UInt32

Event ID 25: This group of events tracks the performance of flushing hives.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofflushinghives.
Opcode: RegPerfOpHiveFlushGatheredPrimaryData

Fields #

Name	Description
`BytesGathered` UInt32

Event ID 26: This group of events tracks the performance of flushing hives.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Level: Informational
Task: Thisgroupofeventstrackstheperformanceofflushinghives.
Opcode: RegPerfOpHiveFlushWroteLogFile

Fields #

Name	Description
`WritesIssued` UInt32
`BytesWritten` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "26",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "13",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-16T00:21:56.779540300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "240",
      "thread_id": "928"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Performance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "WritesIssued": "       1",
    "BytesWritten": "   98304"
  },
  "message": ""
}

Event ID 27: This group of events tracks the performance of flushing hives.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Level: Informational
Task: Thisgroupofeventstrackstheperformanceofflushinghives.
Opcode: RegPerfOpHiveFlushWrotePrimaryFile

Fields #

Name	Description
`WritesIssued` UInt32
`BytesWritten` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "27",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "14",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-16T00:24:00.216602900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "240",
      "thread_id": "932"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Performance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "WritesIssued": "     880",
    "BytesWritten": "  450560"
  },
  "message": ""
}

Event ID 28: Thisgroupofeventstrackstheperformanceofflushinghives.RegPerfOpHiveFlushBoostedActiveFlusher

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofflushinghives.
Opcode: RegPerfOpHiveFlushBoostedActiveFlusher

Event ID 29: Thisgroupofeventstrackstheperformanceofflushinghives.RegPerfOpHiveFlushStartWaitForActive

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofflushinghives.
Opcode: RegPerfOpHiveFlushStartWaitForActive

Event ID 30: Thisgroupofeventstrackstheperformanceofflushinghives.RegPerfOpHiveFlushFinishWaitForActive

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofflushinghives.
Opcode: RegPerfOpHiveFlushFinishWaitForActive

Event ID 31: This group of events tracks the performance of flushing hives.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Level: Informational
Task: Thisgroupofeventstrackstheperformanceofflushinghives.
Opcode: Stop

Fields #

Name	Description
`StatusCode` HexInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "31",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "2",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-16T00:21:56.779593400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "240",
      "thread_id": "928"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Performance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "StatusCode": "0x0"
  },
  "message": ""
}

Event ID 32: Thisgroupofeventstrackstheperformanceofregistryshutdown.Start

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofregistryshutdown.
Opcode: Start

Event ID 33: Thisgroupofeventstrackstheperformanceofregistryshutdown.Start33

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofregistryshutdown.
Opcode: Start

Event ID 34: Thisgroupofeventstrackstheperformanceofregistryshutdown.RegPerfOpShutdownFlushStart

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofregistryshutdown.
Opcode: RegPerfOpShutdownFlushStart

Event ID 35: Thisgroupofeventstrackstheperformanceofregistryshutdown.RegPerfOpShutdownFlushStop

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofregistryshutdown.
Opcode: RegPerfOpShutdownFlushStop

Event ID 36: Thisgroupofeventstrackstheperformanceofregistryshutdown.Stop

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofregistryshutdown.
Opcode: Stop

Event ID 37: This group of events tracks the performance of loading hives.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Level: Informational
Task: Thisgroupofeventstrackstheperformanceofloadinghives.
Opcode: Start

Fields #

Name	Description
`SourceFile` UnicodeString
`Flags` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "37",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "1",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-16T00:23:58.962727700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "4",
      "thread_id": "7308"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Performance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SourceFile": "\\SystemRoot\\System32\\config\\DRIVERS",
    "Flags": "0x80"
  },
  "message": ""
}

Event ID 38: This group of events tracks the performance of loading hives.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Level: Informational
Task: Thisgroupofeventstrackstheperformanceofloadinghives.
Opcode: Stop

Fields #

Name	Description
`StatusCode` HexInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Registry",
    "guid": "{70eb4f03-c1de-4f73-a051-33d13d5413bd}",
    "event_source_name": "",
    "event_id": "38",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "2",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-16T00:23:59.366363400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "4",
      "thread_id": "7308"
    },
    "channel": "Microsoft-Windows-Kernel-Registry/Performance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "StatusCode": "0x0"
  },
  "message": ""
}

Event ID 39: This group of events tracks the performance of restoring hives.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofrestoringhives.
Opcode: Start

Fields #

Name	Description
`SourceFile` UnicodeString
`Flags` HexInt32

Event ID 40: This group of events tracks the performance of restoring hives.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofrestoringhives.
Opcode: Stop

Fields #

Name	Description
`StatusCode` HexInt32	NTSTATUS reference

Event ID 41: This group of events tracks the performance of exporting hives.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofexportinghives.
Opcode: Start

Fields #

Name	Description
`SourceKeyPath` UnicodeString

Event ID 42: Thisgroupofeventstrackstheperformanceofexportinghives.RegPerfOpSaveFileCopied

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofexportinghives.
Opcode: RegPerfOpSaveFileCopied

Event ID 43: Thisgroupofeventstrackstheperformanceofexportinghives.RegPerfOpSaveTreeCopied

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofexportinghives.
Opcode: RegPerfOpSaveTreeCopied

Event ID 44: Thisgroupofeventstrackstheperformanceofexportinghives.RegPerfOpSaveFileWritten

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofexportinghives.
Opcode: RegPerfOpSaveFileWritten

Event ID 45: This group of events tracks the performance of exporting hives.

Provider: Microsoft-Windows-Kernel-Registry
Channel: Performance
Task: Thisgroupofeventstrackstheperformanceofexportinghives.
Opcode: Stop

Fields #

Name	Description
`StatusCode` HexInt32	NTSTATUS reference

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {70EB4F03-C1DE-4F73-A051-33D13D5413BD}

Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · sample captured from a live trace · binary version 10.0.20348.3932 · captured 2026-06-02
WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.3932 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.5074 · captured 2026-06-02

Downloads

Microsoft-Windows-Kernel-Registry registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-Kernel-Registry registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)