Microsoft-Windows-Security-Vault

12 events across 1 channel

Event	Title	Channel
100	CPasswordVaultAdd start	Performance
101	CPasswordVaultAdd stop	Performance
102	CPasswordVaultRemove start	Performance
103	CPasswordVaultRemove stop	Performance
104	CPasswordVaultRetrieve start	Performance
105	CPasswordVaultRetrieve stop	Performance
106	CPasswordVaultFindAllByResource start	Performance
107	CPasswordVaultFindAllByResource stop	Performance
108	CPasswordVaultFindAllByUserName start	Performance
109	CPasswordVaultFindAllByUserName stop	Performance
110	CPasswordVaultRetrieveAll start	Performance
111	CPasswordVaultRetrieveAll stop	Performance

Event ID 100: CPasswordVaultAdd start

Provider: Microsoft-Windows-Security-Vault
Channel: Performance
Task: VaultPerformance
Opcode: Start

Description

CPasswordVaultAdd start.

Message #

CPasswordVaultAdd start

Event ID 101: CPasswordVaultAdd stop

Provider: Microsoft-Windows-Security-Vault
Channel: Performance
Task: VaultPerformance
Opcode: Stop

Description

CPasswordVaultAdd stop.

Message #

CPasswordVaultAdd stop

Event ID 102: CPasswordVaultRemove start

Provider: Microsoft-Windows-Security-Vault
Channel: Performance
Task: VaultPerformance
Opcode: Start

Description

CPasswordVaultRemove start.

Message #

CPasswordVaultRemove start

Event ID 103: CPasswordVaultRemove stop

Provider: Microsoft-Windows-Security-Vault
Channel: Performance
Task: VaultPerformance
Opcode: Stop

Description

CPasswordVaultRemove stop.

Message #

CPasswordVaultRemove stop

Event ID 104: CPasswordVaultRetrieve start

Provider: Microsoft-Windows-Security-Vault
Channel: Performance
Task: VaultPerformance
Opcode: Start

Description

CPasswordVaultRetrieve start.

Message #

CPasswordVaultRetrieve start

Event ID 105: CPasswordVaultRetrieve stop

Provider: Microsoft-Windows-Security-Vault
Channel: Performance
Task: VaultPerformance
Opcode: Stop

Description

CPasswordVaultRetrieve stop.

Message #

CPasswordVaultRetrieve stop

Event ID 106: CPasswordVaultFindAllByResource start

Provider: Microsoft-Windows-Security-Vault
Channel: Performance
Task: VaultPerformance
Opcode: Start

Description

CPasswordVaultFindAllByResource start.

Message #

CPasswordVaultFindAllByResource start

Event ID 107: CPasswordVaultFindAllByResource stop

Provider: Microsoft-Windows-Security-Vault
Channel: Performance
Task: VaultPerformance
Opcode: Stop

Description

CPasswordVaultFindAllByResource stop.

Message #

CPasswordVaultFindAllByResource stop

Event ID 108: CPasswordVaultFindAllByUserName start

Provider: Microsoft-Windows-Security-Vault
Channel: Performance
Task: VaultPerformance
Opcode: Start

Description

CPasswordVaultFindAllByUserName start.

Message #

CPasswordVaultFindAllByUserName start

Event ID 109: CPasswordVaultFindAllByUserName stop

Provider: Microsoft-Windows-Security-Vault
Channel: Performance
Task: VaultPerformance
Opcode: Stop

Description

CPasswordVaultFindAllByUserName stop.

Message #

CPasswordVaultFindAllByUserName stop

Event ID 110: CPasswordVaultRetrieveAll start

Provider: Microsoft-Windows-Security-Vault
Channel: Performance
Task: VaultPerformance
Opcode: Start

Description

CPasswordVaultRetrieveAll start.

Message #

CPasswordVaultRetrieveAll start

Event ID 111: CPasswordVaultRetrieveAll stop

Provider: Microsoft-Windows-Security-Vault
Channel: Performance
Task: VaultPerformance
Opcode: Stop

Description

CPasswordVaultRetrieveAll stop.

Message #

CPasswordVaultRetrieveAll stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID e6c92fb8-89d7-4d1f-be46-d56e59804783

Defined in vaultcli.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Microsoft-Windows-Security-Vault registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-Security-Vault registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)