Microsoft-Windows-Sysprep

14 events across 1 channel

Event	Title	Channel
1001	Executing sysprep providers from registry location "BasePath" during Phase.	Analytic
1002	Finished executing sysprep providers with status ErrorCode.	Analytic
2001	Calling external function "FunctionName" from "DllName".	Analytic
2002	External function returned with status DllName.	Analytic
3001	Loading meta-data file "ActionFilePath".	Analytic
3002	Loading of meta-data file "ActionFilePath" completed.	Analytic
4001	Creating action list for component "ComponentName".	Analytic
4002	Action list for component "ComponentName" created.	Analytic
5001	Deleting file(s) "FilePattern" from directory "DirectoryPath".	Analytic
5002	File deletion of "FilePattern" from directory "DirectoryPath" returned with …	Analytic
6001	Deleting directory "DirectoryPath".	Analytic
6002	Directory deletion for "DirectoryPath" returned with status ErrorCode.	Analytic
7001	Starting execution of phase "Phase".	Analytic
7002	Execution of phase returned status ErrorCode.	Analytic

Event ID 1001: Executing sysprep providers from registry location "BasePath" during Phase.

Provider: Microsoft-Windows-Sysprep
Channel: Analytic
Task: RunRegistryDlls
Opcode: Start

Description

Executing sysprep providers from registry location "BasePath" during Phase.

Message #

Executing sysprep providers from registry location "%1" during %2.

Fields #

Name	Description
`BasePath` UnicodeString
`Phase` UnicodeString

Event ID 1002: Finished executing sysprep providers with status ErrorCode.

Provider: Microsoft-Windows-Sysprep
Channel: Analytic
Task: RunRegistryDlls
Opcode: Stop

Description

Finished executing sysprep providers with status ErrorCode.

Message #

Finished executing sysprep providers with status %1.

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 2001: Calling external function "FunctionName" from "DllName".

Provider: Microsoft-Windows-Sysprep
Channel: Analytic
Task: CallExternalProviderFunction
Opcode: Start

Description

Calling external function "FunctionName" from "DllName".

Message #

Calling external function "%2" from "%1".

Fields #

Name	Description
`DllName` UnicodeString
`FunctionName` AnsiString
`ErrorCode` UInt32

Event ID 2002: External function returned with status DllName.

Provider: Microsoft-Windows-Sysprep
Channel: Analytic
Task: CallExternalProviderFunction
Opcode: Stop

Description

External function returned with status DllName.

Message #

External function returned with status %1.

Fields #

Name	Description
`DllName` UnicodeString
`FunctionName` AnsiString
`ErrorCode` UInt32

Event ID 3001: Loading meta-data file "ActionFilePath".

Provider: Microsoft-Windows-Sysprep
Channel: Analytic
Task: Loadactionmeta_datafile
Opcode: Start

Description

Loading meta-data file "ActionFilePath".

Message #

Loading meta-data file "%1".

Fields #

Name	Description
`ActionFilePath` UnicodeString

Event ID 3002: Loading of meta-data file "ActionFilePath" completed.

Provider: Microsoft-Windows-Sysprep
Channel: Analytic
Task: Loadactionmeta_datafile
Opcode: Stop

Description

Loading of meta-data file "ActionFilePath" completed.

Message #

Loading of meta-data file "%1" completed.

Fields #

Name	Description
`ActionFilePath` UnicodeString

Event ID 4001: Creating action list for component "ComponentName".

Provider: Microsoft-Windows-Sysprep
Channel: Analytic
Task: Createlistofactionsforacomponent
Opcode: Start

Description

Creating action list for component "ComponentName".

Message #

Creating action list for component "%1".

Fields #

Name	Description
`ComponentName` UnicodeString

Event ID 4002: Action list for component "ComponentName" created.

Provider: Microsoft-Windows-Sysprep
Channel: Analytic
Task: Createlistofactionsforacomponent
Opcode: Stop

Description

Action list for component "ComponentName" created.

Message #

Action list for component "%1" created.

Fields #

Name	Description
`ComponentName` UnicodeString

Event ID 5001: Deleting file(s) "FilePattern" from directory "DirectoryPath".

Provider: Microsoft-Windows-Sysprep
Channel: Analytic
Task: Deletingfile(s)ofapattern
Opcode: Start

Description

Deleting file(s) "FilePattern" from directory "DirectoryPath".

Message #

Deleting file(s) "%2" from directory "%1".

Fields #

Name	Description
`DirectoryPath` UnicodeString
`FilePattern` UnicodeString

Event ID 5002: File deletion of "FilePattern" from directory "DirectoryPath" returned with status ErrorCode.

Provider: Microsoft-Windows-Sysprep
Channel: Analytic
Task: Deletingfile(s)ofapattern
Opcode: Stop

Description

File deletion of "FilePattern" from directory "DirectoryPath" returned with status ErrorCode.

Message #

File deletion of "%2" from directory "%1" returned with status %3.

Fields #

Name	Description
`DirectoryPath` UnicodeString
`FilePattern` UnicodeString
`ErrorCode` UInt32

Event ID 6001: Deleting directory "DirectoryPath".

Provider: Microsoft-Windows-Sysprep
Channel: Analytic
Task: Deleteadirectory
Opcode: Start

Description

Deleting directory "DirectoryPath".

Message #

Deleting directory "%1".

Fields #

Name	Description
`DirectoryPath` UnicodeString

Event ID 6002: Directory deletion for "DirectoryPath" returned with status ErrorCode.

Provider: Microsoft-Windows-Sysprep
Channel: Analytic
Task: Deleteadirectory
Opcode: Stop

Description

Directory deletion for "DirectoryPath" returned with status ErrorCode.

Message #

Directory deletion for "%1" returned with status %2.

Fields #

Name	Description
`DirectoryPath` UnicodeString
`ErrorCode` UInt32

Event ID 7001: Starting execution of phase "Phase".

Provider: Microsoft-Windows-Sysprep
Channel: Analytic
Task: Executeanentirephase
Opcode: Start

Description

Starting execution of phase "Phase".

Message #

Starting execution of phase "%1".

Fields #

Name	Description
`Phase` UnicodeString

Event ID 7002: Execution of phase returned status ErrorCode.

Provider: Microsoft-Windows-Sysprep
Channel: Analytic
Task: Executeanentirephase
Opcode: Stop

Description

Execution of phase returned status ErrorCode.

Message #

Execution of phase returned status %1.

Fields #

Name	Description
`ErrorCode` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 75ebc33e-77b8-4ba8-9474-4f4a9db2f5c6

Defined in sysprep.exe, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Microsoft-Windows-Sysprep registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-Sysprep registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)