Microsoft-Windows-ShellLauncher

77 events across 1 channel

Event	Title	Channel
10001	Event ID 10001	Operational
10002	Event ID 10002	Operational
10003	Event ID 10003	Operational
10004	Event ID 10004	Operational
10005	Event ID 10005	Operational
10006	Event ID 10006	Operational
10007	Event ID 10007	Operational
10008	Event ID 10008	Operational
10009	Event ID 10009	Operational
10010	Event ID 10010	Operational
10011	Event ID 10011	Operational
10012	Event ID 10012	Operational
10013	Event ID 10013	Operational
10014	Event ID 10014	Operational
10015	Event ID 10015	Operational
10016	Event ID 10016	Operational
10017	Event ID 10017	Operational
10018	Event ID 10018	Operational
10019	Event ID 10019	Operational
10020	Event ID 10020	Operational
10021	Event ID 10021	Operational
10022	Event ID 10022	Operational
10023	Event ID 10023	Operational
10024	Event ID 10024	Operational
10025	Event ID 10025	Operational
10026	Event ID 10026	Operational
10027	Event ID 10027	Operational
10028	Event ID 10028	Operational
10029	Event ID 10029	Operational
10030	Event ID 10030	Operational
10031	Event ID 10031	Operational
10032	Event ID 10032	Operational
10033	Event ID 10033	Operational
10034	Event ID 10034	Operational
10035	Event ID 10035	Operational
10036	Event ID 10036	Operational
10037	Event ID 10037	Operational
10038	Event ID 10038	Operational
10039	Event ID 10039	Operational
10040	Event ID 10040	Operational
10041	Event ID 10041	Operational
10042	Event ID 10042	Operational
10043	Event ID 10043	Operational
10044	Event ID 10044	Operational
10045	Event ID 10045	Operational
10046	Event ID 10046	Operational
10047	Event ID 10047	Operational
10048	Event ID 10048	Operational
10049	Event ID 10049	Operational
10050	Event ID 10050	Operational
10051	Event ID 10051	Operational
10052	Event ID 10052	Operational
10053	Event ID 10053	Operational
10054	Event ID 10054	Operational
10055	Event ID 10055	Operational
10056	Event ID 10056	Operational
10057	Event ID 10057	Operational
10058	Event ID 10058	Operational
10059	Event ID 10059	Operational
10060	Event ID 10060	Operational
10061	Event ID 10061	Operational
10062	Event ID 10062	Operational
10063	Event ID 10063	Operational
10064	Event ID 10064	Operational
10065	Event ID 10065	Operational
10066	Event ID 10066	Operational
10067	Event ID 10067	Operational
10068	Event ID 10068	Operational
10069	Event ID 10069	Operational
10070	Event ID 10070	Operational
10071	Event ID 10071	Operational
10072	Event ID 10072	Operational
10073	Event ID 10073	Operational
10074	Event ID 10074	Operational
10075	Event ID 10075	Operational
10076	Event ID 10076	Operational
10077	Event ID 10077	Operational

Event ID 10001:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10002:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10003:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString
`ErrorCode` UInt32

Event ID 10004:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10005:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10006:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString
`ErrorCode` UInt32

Event ID 10007:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10008:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10009:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10010:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10011:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString
`ErrorCode` UInt32

Event ID 10012:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10013:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString
`ErrorCode` UInt32

Event ID 10014:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10015:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10016:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10017:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString
`ErrorCode` UInt32

Event ID 10018:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString
`ErrorCode` UInt32

Event ID 10019:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10020:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10021:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10022:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10023:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10024:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10025:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10026:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10027:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10028:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString
`ErrorCode` UInt32

Event ID 10029:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10030:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10031:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10032:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10033:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10034:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10035:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10036:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10037:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10038:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10039:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10040:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10041:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10042:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10043:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10044:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10045:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10046:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10047:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10048:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10049:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10050:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10051:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10052:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10053:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10054:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10055:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10056:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10057:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10058:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10059:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10060:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10061:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10062:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10063:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10064:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10065:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10066:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10067:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10068:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10069:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10070:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10071:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10072:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Event ID 10073:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10074:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10075:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10076:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`Command` UnicodeString

Event ID 10077:

Provider: Microsoft-Windows-ShellLauncher
Channel: Operational
Task: ShellLauncher
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)