Microsoft-Windows-Security-IdentityStore

27 events across 1 channel

Event	Title	Channel
1	CreateConnectedUserStart	Performance
2	CreateConnectedUserStart2	Performance
3	CreateConnectedUserStop	Performance
4	ConnectDisconnectUserStart	Performance
5	ConnectDisconnectUserStop	Performance
6	ConnectDisconnectUserStart6	Performance
7	ConnectDisconnectUserStop7	Performance
8	ConnectDisconnectUserStart8	Performance
9	ConnectDisconnectUserStop9	Performance
10	ConnectDisconnectUserStart10	Performance
11	ConnectDisconnectUserStop11	Performance
12	IdentityQueryStart	Performance
13	IdentityQueryStop	Performance
14	IdentityQuery	Performance
15	IdentityQuery	Performance
16	IdentityQuery	Performance
17	IdentityQuery	Performance
18	IdentityQueryStart18	Performance
19	IdentityQueryStop19	Performance
20	IdentityQueryStart20	Performance
21	IdentityQueryStop21	Performance
22	CreateConnectedUserStart22	Performance
23	CreateConnectedUserStop23	Performance
24	CreateConnectedUserStart24	Performance
25	CreateConnectedUserStop25	Performance
26	ConnectDisconnectUserStart26	Performance
27	ConnectDisconnectUserStop27	Performance

Event ID 1: CreateConnectedUserStart

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: CreateConnectedUser
Opcode: Start

Event ID 2: CreateConnectedUserStart2

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: CreateConnectedUser
Opcode: Start

Event ID 3: CreateConnectedUserStop

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: CreateConnectedUser
Opcode: Stop

Event ID 4: ConnectDisconnectUserStart

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: ConnectDisconnectUser
Opcode: Start

Event ID 5: ConnectDisconnectUserStop

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: ConnectDisconnectUser
Opcode: Stop

Event ID 6: ConnectDisconnectUserStart6

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: ConnectDisconnectUser
Opcode: Start

Event ID 7: ConnectDisconnectUserStop7

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: ConnectDisconnectUser
Opcode: Stop

Event ID 8: ConnectDisconnectUserStart8

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: ConnectDisconnectUser
Opcode: Start

Event ID 9: ConnectDisconnectUserStop9

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: ConnectDisconnectUser
Opcode: Stop

Event ID 10: ConnectDisconnectUserStart10

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: ConnectDisconnectUser
Opcode: Start

Event ID 11: ConnectDisconnectUserStop11

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: ConnectDisconnectUser
Opcode: Stop

Event ID 12: IdentityQueryStart

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: IdentityQuery
Opcode: Start

Event ID 13: IdentityQueryStop

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: IdentityQuery
Opcode: Stop

Event ID 14: IdentityQuery

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Level: Informational
Task: IdentityQuery
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-IdentityStore",
    "guid": "{00B7E1DF-B469-4C69-9C41-53A6576E3DAD}",
    "event_source_name": "",
    "event_id": 14,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T06:02:39.425+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17172,
      "thread_id": 13652
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "IdentityQuery"
}

Event ID 15: IdentityQuery

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Level: Informational
Task: IdentityQuery
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-IdentityStore",
    "guid": "{00B7E1DF-B469-4C69-9C41-53A6576E3DAD}",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 2,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T06:02:39.519+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17172,
      "thread_id": 13652
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "IdentityQuery"
}

Event ID 16: IdentityQuery

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Level: Informational
Task: IdentityQuery
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-IdentityStore",
    "guid": "{00B7E1DF-B469-4C69-9C41-53A6576E3DAD}",
    "event_source_name": "",
    "event_id": 16,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T06:02:39.515+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17172,
      "thread_id": 13652
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "IdentityQuery"
}

Event ID 17: IdentityQuery

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Level: Informational
Task: IdentityQuery
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-IdentityStore",
    "guid": "{00B7E1DF-B469-4C69-9C41-53A6576E3DAD}",
    "event_source_name": "",
    "event_id": 17,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 2,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T06:02:39.516+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17172,
      "thread_id": 13652
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "IdentityQuery"
}

Event ID 18: IdentityQueryStart18

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: IdentityQuery
Opcode: Start

Event ID 19: IdentityQueryStop19

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: IdentityQuery
Opcode: Stop

Event ID 20: IdentityQueryStart20

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: IdentityQuery
Opcode: Start

Event ID 21: IdentityQueryStop21

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: IdentityQuery
Opcode: Stop

Event ID 22: CreateConnectedUserStart22

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: CreateConnectedUser
Opcode: Start

Event ID 23: CreateConnectedUserStop23

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: CreateConnectedUser
Opcode: Stop

Event ID 24: CreateConnectedUserStart24

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: CreateConnectedUser
Opcode: Start

Event ID 25: CreateConnectedUserStop25

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: CreateConnectedUser
Opcode: Stop

Event ID 26: ConnectDisconnectUserStart26

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: ConnectDisconnectUser
Opcode: Start

Event ID 27: ConnectDisconnectUserStop27

Provider: Microsoft-Windows-Security-IdentityStore
Channel: Performance
Task: ConnectDisconnectUser
Opcode: Stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {00B7E1DF-B469-4C69-9C41-53A6576E3DAD}

Defined in idstore.dll, which carries the event manifest.

Observed on:

Win11-26200.6584 · sample captured from a live trace · binary version 10.0.26100.5074 · captured 2026-06-02
WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.2849 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.5074 · captured 2026-06-02

Downloads

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-Security-IdentityStore

Event ID 1: CreateConnectedUserStart

Event ID 2: CreateConnectedUserStart2

Event ID 3: CreateConnectedUserStop

Event ID 4: ConnectDisconnectUserStart

Event ID 5: ConnectDisconnectUserStop

Event ID 6: ConnectDisconnectUserStart6

Event ID 7: ConnectDisconnectUserStop7

Event ID 8: ConnectDisconnectUserStart8

Event ID 9: ConnectDisconnectUserStop9

Event ID 10: ConnectDisconnectUserStart10

Event ID 11: ConnectDisconnectUserStop11

Event ID 12: IdentityQueryStart

Event ID 13: IdentityQueryStop

Event ID 14: IdentityQuery

Example Event #

Event ID 15: IdentityQuery

Example Event #

Event ID 16: IdentityQuery

Example Event #

Event ID 17: IdentityQuery

Example Event #

Event ID 18: IdentityQueryStart18

Event ID 19: IdentityQueryStop19

Event ID 20: IdentityQueryStart20

Event ID 21: IdentityQueryStop21

Event ID 22: CreateConnectedUserStart22

Event ID 23: CreateConnectedUserStop23

Event ID 24: CreateConnectedUserStart24

Event ID 25: CreateConnectedUserStop25

Event ID 26: ConnectDisconnectUserStart26

Event ID 27: ConnectDisconnectUserStop27

Provenance

Downloads

Credits

Keyboard shortcuts

Search operators