Microsoft-Windows-Mobile-Broadband-Experience-SmsApi

15 events across 2 channels

Event	Title	Channel
1000	ReceiveMessageStart	Analytic
1001	ReceiveMessageStop	Analytic
1002	SendMessageStart	Analytic
1003	SendMessageStop	Analytic
1004	GetMessageStart	Analytic
1005	GetMessageStop	Analytic
1006	GetMessagesStart	Analytic
1007	GetMessagesStop	Analytic
1008	DeleteMessageStart	Analytic
1009	DeleteMessageStop	Analytic
1010	DeleteMessagesStart	Analytic
1011	DeleteMessagesStop	Analytic
5001	App: appId read one or more SMS text messages on mobile broadband device: …	SMSApi
5002	App: appId sent SMS text message on mobile broadband device: interfaceId.	SMSApi
5003	App: appId deleted one or more SMS text messages on mobile broadband device: …	SMSApi

Event ID 1000: ReceiveMessageStart

Provider: Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Channel: Analytic
Task: ReceiveMessage
Opcode: Start

Event ID 1001: ReceiveMessageStop

Provider: Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Channel: Analytic
Task: ReceiveMessage
Opcode: Stop

Event ID 1002: SendMessageStart

Provider: Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Channel: Analytic
Task: SendMessage
Opcode: Start

Event ID 1003: SendMessageStop

Provider: Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Channel: Analytic
Task: SendMessage
Opcode: Stop

Event ID 1004: GetMessageStart

Provider: Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Channel: Analytic
Task: GetMessage
Opcode: Start

Event ID 1005: GetMessageStop

Provider: Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Channel: Analytic
Task: GetMessage
Opcode: Stop

Event ID 1006: GetMessagesStart

Provider: Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Channel: Analytic
Task: GetMessages
Opcode: Start

Event ID 1007: GetMessagesStop

Provider: Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Channel: Analytic
Task: GetMessages
Opcode: Stop

Event ID 1008: DeleteMessageStart

Provider: Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Channel: Analytic
Task: DeleteMessage
Opcode: Start

Event ID 1009: DeleteMessageStop

Provider: Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Channel: Analytic
Task: DeleteMessage
Opcode: Stop

Event ID 1010: DeleteMessagesStart

Provider: Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Channel: Analytic
Task: DeleteMessages
Opcode: Start

Event ID 1011: DeleteMessagesStop

Provider: Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Channel: Analytic
Task: DeleteMessages
Opcode: Stop

Event ID 5001: App: appId read one or more SMS text messages on mobile broadband device: interfaceId.

Provider: Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Channel: SMSApi
Opcode: Info

Description

App: appId read one or more SMS text messages on mobile broadband device: interfaceId.

Message #

App: %1 read one or more SMS text messages on mobile broadband device: %2.

Fields #

Name	Description
`appId` UnicodeString
`interfaceId` UnicodeString

Event ID 5002: App: appId sent SMS text message on mobile broadband device: interfaceId.

Provider: Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Channel: SMSApi
Opcode: Info

Description

App: appId sent SMS text message on mobile broadband device: interfaceId.

Message #

App: %1 sent SMS text message on mobile broadband device: %2.

Fields #

Name	Description
`appId` UnicodeString
`interfaceId` UnicodeString

Event ID 5003: App: appId deleted one or more SMS text messages on mobile broadband device: interfaceId.

Provider: Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Channel: SMSApi
Opcode: Info

Description

App: appId deleted one or more SMS text messages on mobile broadband device: interfaceId.

Message #

App: %1 deleted one or more SMS text messages on mobile broadband device: %2.

Fields #

Name	Description
`appId` UnicodeString
`interfaceId` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 0ff1c24b-7f05-45c0-abdc-3c8521be4f62

Defined in MbSmsApi.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.2849 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.5074 · captured 2026-06-02

Downloads

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-Mobile-Broadband-Experience-SmsApi

Event ID 1000: ReceiveMessageStart

Event ID 1001: ReceiveMessageStop

Event ID 1002: SendMessageStart

Event ID 1003: SendMessageStop

Event ID 1004: GetMessageStart

Event ID 1005: GetMessageStop

Event ID 1006: GetMessagesStart

Event ID 1007: GetMessagesStop

Event ID 1008: DeleteMessageStart

Event ID 1009: DeleteMessageStop

Event ID 1010: DeleteMessagesStart

Event ID 1011: DeleteMessagesStop

Event ID 5001: App: appId read one or more SMS text messages on mobile broadband device: interfaceId.

Description

Message #

Fields #

Event ID 5002: App: appId sent SMS text message on mobile broadband device: interfaceId.

Description

Message #

Fields #

Event ID 5003: App: appId deleted one or more SMS text messages on mobile broadband device: interfaceId.

Description

Message #

Fields #

Provenance

Downloads

Credits

Keyboard shortcuts

Search operators