detection.wiki

Microsoft-Windows-TimeBroker

4 events across 1 channel

Event IDTitleChannel
1Event ID BrokeredEventId changed state from OldState to NewState.TimeBroker
2Event ID BrokeredEventId is set to fire between StartTime and EndTime.TimeBroker
3TimeBroker CreateEvent called for Event ID BrokeredEventId with Event Type …TimeBroker
4TimeBroker DeleteEvent called for Event ID BrokeredEventId and returned Status.TimeBroker

Event ID 1 — Event ID BrokeredEventId changed state from OldState to NewState.

Provider
Microsoft-Windows-TimeBroker
Channel
TimeBroker

Description

Event ID BrokeredEventId changed state from OldState to NewState.

Message #

Event ID %1 changed state from %2 to %3

Fields #

NameDescription
BrokeredEventId GUID—
OldState UInt32—
NewState UInt32—

Event ID 2 — Event ID BrokeredEventId is set to fire between StartTime and EndTime.

Provider
Microsoft-Windows-TimeBroker
Channel
TimeBroker

Description

Event ID BrokeredEventId is set to fire between StartTime and EndTime.

Message #

Event ID %1 is set to fire between %2 and %3

Fields #

NameDescription
BrokeredEventId GUID—
StartTime FILETIME—
EndTime FILETIME—

Event ID 3 — TimeBroker CreateEvent called for Event ID BrokeredEventId with Event Type EventType returned Status.

Provider
Microsoft-Windows-TimeBroker
Channel
TimeBroker

Description

TimeBroker CreateEvent called for Event ID BrokeredEventId with Event Type EventType returned Status.

Message #

TimeBroker CreateEvent called for Event ID %1 with Event Type %2 returned %3

Fields #

NameDescription
BrokeredEventId GUID—
EventType UInt32—
Status HexInt32— NTSTATUS reference

Event ID 4 — TimeBroker DeleteEvent called for Event ID BrokeredEventId and returned Status.

Provider
Microsoft-Windows-TimeBroker
Channel
TimeBroker

Description

TimeBroker DeleteEvent called for Event ID BrokeredEventId and returned Status.

Message #

TimeBroker DeleteEvent called for Event ID %1 and returned %2

Fields #

NameDescription
BrokeredEventId GUID—
Status HexInt32— NTSTATUS reference