Microsoft-Windows-MMCSS

16 events across 1 channel

Event	Title	Channel
1	Thread priority of.	Operational
2	Scheduler woke up for reason Reason.	Operational
3	Scheduler thread slept.	Operational
5	MMCSS Service started.	Operational
6	MMCSS Service stopped.	Operational
7	Thread joined MMCSS Task TaskName.	Operational
8	Thread left MMCSS	Operational
12	TaskIndex TaskIndex yielded for Duration hectons.	Operational
13	TaskIndex TaskIndex canceled a registered yield.	Operational
14	TaskIndex TaskIndex sets multimedia mode to ThreadTag.	Operational
15	TaskIndex TaskIndex deadline Expired.	Operational
16	Notify Power Manger to engage turbo mode (TurboEngaged).	Operational
17	Thread Buffering Start (ThreadID).	Operational
18	Thread Buffering Stop (ThreadID).	Operational
19	TaskIndex TaskIndex predeadline Expired.	Operational
20	Thread joined MMCSS TaskIndex TaskIndex TaskName1 TaskName1 TaskName2 TaskName2.	Operational

Event ID 1: Thread priority of.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Scheduler_Priority_Change

Description

Thread priority of (ProcessID.ThreadID) in task TaskIndex has changed to Priority.

Message #

Thread priority of (%1.%2) in task %4 has changed to %3.

Fields #

Name	Description
`ProcessID` UInt32
`ThreadID` UInt32
`Priority` UInt8
`TaskIndex` UInt32

Event ID 2: Scheduler woke up for reason Reason.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Scheduler_Wakeup

Description

Scheduler woke up for reason Reason.

Message #

Scheduler woke up for reason %1.

Fields #

Name	Description
`Reason` UInt32

Event ID 3: Scheduler thread slept.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Scheduler_Sleep

Description

Scheduler thread slept.

Message #

Scheduler thread slept.

Fields #

Name	Description
`Reason` UInt32
`Duration` UInt32

Event ID 5: MMCSS Service started.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Service_Start

Description

MMCSS Service started.

Message #

MMCSS Service started.

Event ID 6: MMCSS Service stopped.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Service_Stop

Description

MMCSS Service stopped.

Message #

MMCSS Service stopped.

Event ID 7: Thread joined MMCSS Task TaskName.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Thread_Join

Description

Thread joined MMCSS Task TaskName.

Message #

Thread joined MMCSS Task %5

Fields #

Name	Description
`ThreadID` UInt32
`MediumPriority` UInt8
`LowPriority` UInt8
`UberLowPriority` UInt8
`TaskName` UnicodeString
`TaskIndex` UInt32
`Category` UInt8
`Flags` UInt8

Event ID 8: Thread left MMCSS

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Thread_Leave

Description

Thread left MMCSS.

Message #

Thread left MMCSS

Fields #

Name	Description
`ThreadID` UInt32
`OriginalBasePriority` UInt8

Event ID 12: TaskIndex TaskIndex yielded for Duration hectons.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: TaskIndex_Yield

Description

TaskIndex TaskIndex yielded for Duration hectons.

Message #

TaskIndex %1 yielded for %2 hectons

Fields #

Name	Description
`TaskIndex` UInt32
`Duration` UInt32
`PreDuration` UInt32

Event ID 13: TaskIndex TaskIndex canceled a registered yield.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: TaskIndex_YieldCancel

Description

TaskIndex TaskIndex canceled a registered yield.

Message #

TaskIndex %1 canceled a registered yield

Fields #

Name	Description
`TaskIndex` UInt32

Event ID 14: TaskIndex TaskIndex sets multimedia mode to ThreadTag.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Set_MultimediaMode

Description

TaskIndex TaskIndex sets multimedia mode to ThreadTag.

Message #

TaskIndex %1 sets multimedia mode to %2

Fields #

Name	Description
`TaskIndex` UInt32
`ThreadTag` UInt32

Event ID 15: TaskIndex TaskIndex deadline Expired.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: TaskIndex_DeadlineExpired

Description

TaskIndex TaskIndex deadline Expired.

Message #

TaskIndex %1 deadline Expired

Fields #

Name	Description
`TaskIndex` UInt32

Event ID 16: Notify Power Manger to engage turbo mode (TurboEngaged).

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: TurboEngaged

Description

Notify Power Manger to engage turbo mode (TurboEngaged).

Message #

Notify Power Manger to engage turbo mode (%1)

Fields #

Name	Description
`TurboEngaged` UInt32

Event ID 17: Thread Buffering Start (ThreadID).

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: ThreadBuffering
Opcode: Start

Description

Thread Buffering Start (ThreadID).

Message #

Thread Buffering Start (%1)

Fields #

Name	Description
`ThreadID` UInt32

Event ID 18: Thread Buffering Stop (ThreadID).

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: ThreadBuffering
Opcode: Stop

Description

Thread Buffering Stop (ThreadID).

Message #

Thread Buffering Stop (%1)

Fields #

Name	Description
`ThreadID` UInt32

Event ID 19: TaskIndex TaskIndex predeadline Expired.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: TaskIndex_PreDeadlineExpired

Description

TaskIndex TaskIndex predeadline Expired.

Message #

TaskIndex %1 predeadline Expired

Fields #

Name	Description
`TaskIndex` UInt32

Event ID 20: Thread joined MMCSS TaskIndex TaskIndex TaskName1 TaskName1 TaskName2 TaskName2.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Thread_SetChars

Description

Thread joined MMCSS TaskIndex TaskIndex TaskName1 TaskName1 TaskName2 TaskName2.

Message #

Thread joined MMCSS TaskIndex %1 TaskName1 %2 TaskName2 %3

Fields #

Name	Description
`TaskIndex` UInt32
`TaskName1` UnicodeString
`TaskName2` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 36008301-e154-466c-acec-5f4cbd6b4694

Defined in avrt.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Microsoft-Windows-MMCSS registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-MMCSS registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)