detection.wiki

Microsoft-Windows-ntshrui

24 events across 2 channels

Event IDTitleChannel
1000Microsoft-Windows-ntshrui
1002Microsoft-Windows-ntshrui
1003Microsoft-Windows-ntshrui
1004Microsoft-Windows-ntshrui
1005Microsoft-Windows-ntshrui
1006Microsoft-Windows-ntshrui
1007Microsoft-Windows-ntshrui
1008Microsoft-Windows-ntshrui
1009Microsoft-Windows-ntshrui
1010Microsoft-Windows-ntshrui
1011Microsoft-Windows-ntshrui
1012Microsoft-Windows-ntshrui
1013Microsoft-Windows-ntshrui
1014Microsoft-Windows-ntshrui
1015Microsoft-Windows-ntshrui
1016Microsoft-Windows-ntshrui
1017Microsoft-Windows-ntshrui
1018Microsoft-Windows-ntshrui
1019Microsoft-Windows-ntshrui
1020Microsoft-Windows-ntshrui
1021Microsoft-Windows-ntshrui
1022Microsoft-Windows-ntshrui
5001Microsoft-Windows-ntshrui-perf
5002Microsoft-Windows-ntshrui-perf

Event ID 1000 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
Sharing
Opcode
Start

Event ID 1002 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
Sharing
Opcode
Stop

Event ID 1003 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
StopSharing
Opcode
Start

Event ID 1004 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
StopSharing
Opcode
Stop

Event ID 1005 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
SMB_Sharing
Opcode
Start

Event ID 1006 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
SMB_Sharing
Opcode
Stop

Event ID 1007 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
SMB_StopSharing
Opcode
Start

Event ID 1008 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
SMB_StopSharing
Opcode
Stop

Event ID 1009 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
Inplace_Sharing
Opcode
Start

Event ID 1010 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
Inplace_Sharing
Opcode
Stop

Event ID 1011 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
Inplace_StopSharing
Opcode
Start

Event ID 1012 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
Inplace_StopSharing
Opcode
Stop

Event ID 1013 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
Sharing_End_To_End_Including_UI
Opcode
Start

Event ID 1014 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
Sharing_End_To_End_Including_UI
Opcode
Stop

Event ID 1015 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
Sharing_Add_User_To_Sharing_Permissions
Opcode
Start

Event ID 1016 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
Sharing_Add_User_To_Sharing_Permissions
Opcode
Stop

Event ID 1017 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
SharingWizard_Display
Opcode
Start

Event ID 1018 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
SharingWizard_Display
Opcode
Stop

Event ID 1019 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
Publish_Items
Opcode
Start

Event ID 1020 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
Publish_Items
Opcode
Stop

Event ID 1021 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
Minimized_Sharing_Wizard_End_To_End
Opcode
Start

Event ID 1022 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui
Task
Minimized_Sharing_Wizard_End_To_End
Opcode
Stop

Event ID 5001 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui-perf
Task
Perf_ContextMenu_SpecificUsers
Opcode
Start

Event ID 5002 —

Provider
Microsoft-Windows-ntshrui
Channel
Microsoft-Windows-ntshrui-perf
Task
Perf_ContextMenu_SpecificUsers
Opcode
Stop