detection.wiki
Blog

Microsoft-Windows-Power-Troubleshooter

1 events across 1 channel

Event IDTitleChannel
1The system has returned from a low power state.System

Event ID 1 — The system has returned from a low power state.

Provider
Microsoft-Windows-Power-Troubleshooter
Channel
System
Level
4
Samples
1

Message

The system has returned from a low power state.

Sleep Time: %1
Wake Time: %2

Wake Source: %13%15

Fields

NameDescription
Sleep_Time—
Wake_Time—
Wake_Source—

Example Event

system:
  provider: Microsoft-Windows-Power-Troubleshooter
  guid: CDC05E28-C449-49C6-B9D2-88CF761644DF
  event_source_name: ''
  event_id: 1
  version: 1
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2016-08-18T16:24:10.343750Z'
  event_record_id: 5527
  correlation:
    '#attributes':
      ActivityID: 3ECFB8FA-BDBD-499A-81BD-B8EA8FA7E876
  execution:
    process_id: 1272
    thread_id: 1984
  channel: System
  computer: IE10Win7
  security:
    user_id: S-1-5-19
event_data:
  SleepTime: '2016-08-18T16:22:10.749023Z'
  WakeTime: '2016-08-18T16:24:08.406250Z'
  SleepDuration: 12406
  WakeDuration: 899
  DriverInitDuration: 728
  BiosInitDuration: 0
  HiberWriteDuration: 0
  HiberReadDuration: 0
  HiberPagesWritten: 0
  Attributes: 19456
  TargetState: 2
  EffectiveState: 2
  WakeSourceType: 1
  WakeSourceTextLength: 0
  WakeSourceText: ''
  WakeTimerOwnerLength: 0
  WakeTimerContextLength: 0
  WakeTimerOwner: ''
  WakeTimerContext: ''

References