Microsoft-Windows-TSF-msctf

95 events across 1 channel

Event	Title	Channel
1	InitMSCTFForProcess	Diagnostic
2	InitMSCTFForProcess	Diagnostic
3	UninitMSCTFForProcess	Diagnostic
4	UninitMSCTFForProcess	Diagnostic
5	ActivateCiceroForThread	Diagnostic
6	ActivateCiceroForThread	Diagnostic
7	ActivateCiceroForThread	Diagnostic
8	DeactivateCiceroForThread	Diagnostic
9	DeactivateCiceroForThread	Diagnostic
10	FLSCallback	Diagnostic
11	FLSCallback	Diagnostic
12	ConnectServer	Diagnostic
13	ConnectServer	Diagnostic
14	ConnectServer	Diagnostic
15	task_0	Diagnostic
16	CreateMessageWindow	Diagnostic
17	CreateMessageWindow17	Diagnostic
18	task_018	Diagnostic
19	ActivateTIPStart	Diagnostic
20	ActivateTIPStop	Diagnostic
21	DeactivateTIPStart	Diagnostic
22	DeactivateTIPStop	Diagnostic
23	CheckLastWindowDestroyedStart	Diagnostic
24	CheckLastWindowDestroyedStop	Diagnostic
25	CreateAssemblyListStart	Diagnostic
26	CreateAssemblyListStop	Diagnostic
27	LoadAssemblyListStart	Diagnostic
28	LoadAssemblyListStop	Diagnostic
29	ActivateAssemblyStart	Diagnostic
30	ActivateAssemblyStop	Diagnostic
31	HandleThreadInputFocusEventStart	Diagnostic
32	HandleThreadInputFocusEventStop	Diagnostic
33	HandleGlobalInputFocusEventStart	Diagnostic
34	HandleGlobalInputFocusEventStop	Diagnostic
35	SendNotification	Diagnostic
36	SendSyncRequest	Diagnostic
37	SendSyncRequest	Diagnostic
38	SendAsyncRequestStart	Diagnostic
39	SendAsyncRequestStop	Diagnostic
40	ReceiveALPCMessagesStart	Diagnostic
41	ReceiveALPCMessagesStop	Diagnostic
42	ProcessALPCMessageStart	Diagnostic
43	ProcessALPCMessageStop	Diagnostic
44	ProcessALPCMessageStop44	Diagnostic
45	ProcessALPCMessageReply	Diagnostic
46	CreateLangBarItemMgrStart	Diagnostic
47	CreateLangBarItemMgrStop	Diagnostic
48	GetIconFromFileStart	Diagnostic
49	GetIconFromFileStop	Diagnostic
50	CreateBitmapStart	Diagnostic
51	CreateBitmapStop	Diagnostic
52	ITfThreadFocusSink_OnSetThreadFocusStart	Diagnostic
53	ITfThreadFocusSink_OnSetThreadFocusStop	Diagnostic
54	ITfThreadFocusSink_OnKillThreadFocusStart	Diagnostic
55	ITfThreadFocusSink_OnKillThreadFocusStop	Diagnostic
56	ITfThreadMgrEventSink_OnSetFocusStart	Diagnostic
57	ITfThreadMgrEventSink_OnSetFocusStop	Diagnostic
58	CiceroServerStart	Diagnostic
59	CiceroServerStop	Diagnostic
60	CiceroServer	Diagnostic
61	CiceroServer61	Diagnostic
62	CiceroServer62	Diagnostic
63	CiceroServer63	Diagnostic
64	task_064	Diagnostic
65	IMELocalServer	Diagnostic
66	IMELocalServer66	Diagnostic
67	IMELocalServer67	Diagnostic
68	IMELocalServer68	Diagnostic
69	IMELocalServer69	Diagnostic
70	IMELocalServer70	Diagnostic
71	IMELocalServerStart	Diagnostic
72	IMELocalServerStop	Diagnostic
73	InputProfileActivation	Diagnostic
74	InputProfileActivation74	Diagnostic
75	InputProfileActivation75	Diagnostic
76	InputProfileDeactivation	Diagnostic
77	InputProfileDeactivation77	Diagnostic
78	InputProfileDeactivation78	Diagnostic
79	DocumentFocusChange	Diagnostic
80	DocumentFocusChange80	Diagnostic
81	DocumentFocusChange81	Diagnostic
82	DocumentFocusChange82	Diagnostic
83	DocumentContentChange	Diagnostic
84	DocumentContentChange84	Diagnostic
85	DocumentContentChange85	Diagnostic
86	DocumentContentChange86	Diagnostic
87	KeyboardEventHandling	Diagnostic
88	KeyboardEventHandling88	Diagnostic
89	KeyboardEventHandling89	Diagnostic
90	KeyboardEventHandling90	Diagnostic
91	KeyboardEventHandling91	Diagnostic
92	KeyboardEventHandling92	Diagnostic
93	KeyboardEventHandling93	Diagnostic
94	KeyboardEventHandling94	Diagnostic
95	KeyboardEventHandling95	Diagnostic

Event ID 1: InitMSCTFForProcess

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Level: Informational
Task: InitMSCTFForProcess
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 1,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T05:32:12.637+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 9660,
      "thread_id": 16940
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "InitMSCTFForProcess"
}

Event ID 2: InitMSCTFForProcess

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Level: Informational
Task: InitMSCTFForProcess
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 2,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T05:32:12.637+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 9660,
      "thread_id": 16940
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "InitMSCTFForProcess"
}

Event ID 3: UninitMSCTFForProcess

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Level: Informational
Task: UninitMSCTFForProcess
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 1,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T06:05:39.831+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 14036,
      "thread_id": 8384
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "UninitMSCTFForProcess"
}

Event ID 4: UninitMSCTFForProcess

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Level: Informational
Task: UninitMSCTFForProcess
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 2,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T06:05:39.831+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 14036,
      "thread_id": 8384
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "UninitMSCTFForProcess"
}

Event ID 5: ActivateCiceroForThread

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ActivateCiceroForThread
Opcode: Start

Fields #

Name	Description
`thread_flags` UInt32
`activation_flags` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 5,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 1,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T06:05:39.495+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "activation_flags": 2147483681,
    "thread_flags": 0
  },
  "message": "ActivateCiceroForThread"
}

Event ID 6: ActivateCiceroForThread

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ActivateCiceroForThread

Event ID 7: ActivateCiceroForThread

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ActivateCiceroForThread
Opcode: Stop

Fields #

Name	Description
`thread_flags` UInt32
`activation_flags` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 7,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 2,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T06:05:39.502+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "activation_flags": 0,
    "thread_flags": 33
  },
  "message": "ActivateCiceroForThread"
}

Event ID 8: DeactivateCiceroForThread

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Level: Informational
Task: DeactivateCiceroForThread
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 8,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 1,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T06:05:40.074+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "DeactivateCiceroForThread"
}

Event ID 9: DeactivateCiceroForThread

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Level: Informational
Task: DeactivateCiceroForThread
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 9,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 2,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T06:05:40.074+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "DeactivateCiceroForThread"
}

Event ID 10: FLSCallback

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Level: Informational
Task: FLSCallback
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 10,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 1,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T06:05:40.072+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "FLSCallback"
}

Event ID 11: FLSCallback

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Level: Informational
Task: FLSCallback
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 11,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 2,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T06:05:40.075+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "FLSCallback"
}

Event ID 12: ConnectServer

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Level: Informational
Task: ConnectServer
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 12,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 1,
    "keywords": "0x0000000000220000",
    "time_created": "2026-06-02T06:05:39.496+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "ConnectServer"
}

Event ID 13: ConnectServer

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ConnectServer

Event ID 14: ConnectServer

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Level: Informational
Task: ConnectServer
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 14,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 2,
    "keywords": "0x0000000000220000",
    "time_created": "2026-06-02T06:05:39.497+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "ConnectServer"
}

Event ID 15: task_0

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Level: Informational
Opcode: Info

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000210000",
    "time_created": "2026-06-02T06:05:39.500+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 16: CreateMessageWindow

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Level: Informational
Task: CreateMessageWindow
Opcode: win:Info

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 16,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 0,
    "keywords": "0x0000000000010000",
    "time_created": "2026-06-02T06:05:39.496+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "CreateMessageWindow"
}

Event ID 17: CreateMessageWindow17

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: CreateMessageWindow

Event ID 18: task_018

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Level: Informational
Opcode: Info

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 18,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000010000",
    "time_created": "2026-06-02T06:05:39.499+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 19: ActivateTIPStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ActivateTIP
Opcode: Start

Fields #

Name	Description
`guid` GUID

Event ID 20: ActivateTIPStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ActivateTIP
Opcode: Stop

Fields #

Name	Description
`guid` GUID

Event ID 21: DeactivateTIPStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: DeactivateTIP
Opcode: Start

Fields #

Name	Description
`guid` GUID

Event ID 22: DeactivateTIPStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: DeactivateTIP
Opcode: Stop

Fields #

Name	Description
`guid` GUID

Event ID 23: CheckLastWindowDestroyedStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: CheckLastWindowDestroyed
Opcode: Start

Event ID 24: CheckLastWindowDestroyedStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: CheckLastWindowDestroyed
Opcode: Stop

Event ID 25: CreateAssemblyListStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: CreateAssemblyList
Opcode: Start

Event ID 26: CreateAssemblyListStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: CreateAssemblyList
Opcode: Stop

Event ID 27: LoadAssemblyListStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: LoadAssemblyList
Opcode: Start

Event ID 28: LoadAssemblyListStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: LoadAssemblyList
Opcode: Stop

Event ID 29: ActivateAssemblyStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ActivateAssembly
Opcode: Start

Fields #

Name	Description
`LANGID` UInt32

Event ID 30: ActivateAssemblyStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ActivateAssembly
Opcode: Stop

Fields #

Name	Description
`LANGID` UInt32

Event ID 31: HandleThreadInputFocusEventStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: HandleThreadInputFocusEvent
Opcode: Start

Fields #

Name	Description
`event` UInt32
`hwnd` Pointer
`flags` UInt32
`event_order` UInt32

Event ID 32: HandleThreadInputFocusEventStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: HandleThreadInputFocusEvent
Opcode: Stop

Fields #

Name	Description
`hwnd` Pointer

Event ID 33: HandleGlobalInputFocusEventStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: HandleGlobalInputFocusEvent
Opcode: Start

Fields #

Name	Description
`event` UInt32
`hwnd` Pointer
`flags` UInt32
`event_order` UInt32

Event ID 34: HandleGlobalInputFocusEventStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: HandleGlobalInputFocusEvent
Opcode: Stop

Event ID 35: SendNotification

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SendNotification
Opcode: Send

Fields #

Name	Description
`message` UInt32
`target_tid` UInt32
`params` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 35,
    "version": 0,
    "level": 4,
    "task": 19,
    "opcode": 9,
    "keywords": "0x0000000000200000",
    "time_created": "2026-06-02T06:05:39.502+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "message": 16777242,
    "params": 8,
    "target_tid": 0
  },
  "message": "SendNotification"
}

Event ID 36: SendSyncRequest

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SendSyncRequest
Opcode: Suspend

Fields #

Name	Description
`message` UInt32
`target_tid` UInt32
`params` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 36,
    "version": 0,
    "level": 4,
    "task": 20,
    "opcode": 8,
    "keywords": "0x0000000000200000",
    "time_created": "2026-06-02T06:05:39.498+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "message": 21,
    "params": 0,
    "target_tid": 0
  },
  "message": "SendSyncRequest"
}

Event ID 37: SendSyncRequest

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Level: Informational
Task: SendSyncRequest
Opcode: Resume

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 37,
    "version": 0,
    "level": 4,
    "task": 20,
    "opcode": 7,
    "keywords": "0x0000000000200000",
    "time_created": "2026-06-02T06:05:39.499+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SendSyncRequest"
}

Event ID 38: SendAsyncRequestStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: SendAsyncRequest
Opcode: Start

Fields #

Name	Description
`message` UInt32
`target_tid` UInt32
`params` UInt32

Event ID 39: SendAsyncRequestStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: SendAsyncRequest
Opcode: Stop

Event ID 40: ReceiveALPCMessagesStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ReceiveALPCMessages
Opcode: Start

Event ID 41: ReceiveALPCMessagesStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ReceiveALPCMessages
Opcode: Stop

Event ID 42: ProcessALPCMessageStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ProcessALPCMessage
Opcode: Start

Fields #

Name	Description
`message` UInt32
`target_tid` UInt32
`params` UInt32

Event ID 43: ProcessALPCMessageStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ProcessALPCMessage
Opcode: Stop

Fields #

Name	Description
`param` UInt32

Event ID 44: ProcessALPCMessageStop44

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ProcessALPCMessage
Opcode: Stop

Event ID 45: ProcessALPCMessageReply

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ProcessALPCMessage
Opcode: Reply

Fields #

Name	Description
`message` UInt32
`target_tid` UInt32
`params` UInt32
`hr` UInt32

Event ID 46: CreateLangBarItemMgrStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: CreateLangBarItemMgr
Opcode: Start

Event ID 47: CreateLangBarItemMgrStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: CreateLangBarItemMgr
Opcode: Stop

Event ID 48: GetIconFromFileStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: GetIconFromFile
Opcode: Start

Event ID 49: GetIconFromFileStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: GetIconFromFile
Opcode: Stop

Event ID 50: CreateBitmapStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: CreateBitmap
Opcode: Start

Event ID 51: CreateBitmapStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: CreateBitmap
Opcode: Stop

Event ID 52: ITfThreadFocusSink_OnSetThreadFocusStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ITfThreadFocusSink_OnSetThreadFocus
Opcode: Start

Fields #

Name	Description
`param` UInt32

Event ID 53: ITfThreadFocusSink_OnSetThreadFocusStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ITfThreadFocusSink_OnSetThreadFocus
Opcode: Stop

Fields #

Name	Description
`param` UInt32

Event ID 54: ITfThreadFocusSink_OnKillThreadFocusStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ITfThreadFocusSink_OnKillThreadFocus
Opcode: Start

Fields #

Name	Description
`param` UInt32

Event ID 55: ITfThreadFocusSink_OnKillThreadFocusStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ITfThreadFocusSink_OnKillThreadFocus
Opcode: Stop

Fields #

Name	Description
`param` UInt32

Event ID 56: ITfThreadMgrEventSink_OnSetFocusStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ITfThreadMgrEventSink_OnSetFocus
Opcode: Start

Fields #

Name	Description
`pdimNewFocus` Pointer
`pdimPrevFocus` Pointer

Event ID 57: ITfThreadMgrEventSink_OnSetFocusStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: ITfThreadMgrEventSink_OnSetFocus
Opcode: Stop

Fields #

Name	Description
`pdimNewFocus` Pointer
`pdimPrevFocus` Pointer

Event ID 58: CiceroServerStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: CiceroServer
Opcode: Start

Fields #

Name	Description
`param` UInt32

Event ID 59: CiceroServerStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: CiceroServer
Opcode: Stop

Fields #

Name	Description
`param` UInt32

Event ID 60: CiceroServer

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: CiceroServer

Event ID 61: CiceroServer61

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: CiceroServer

Event ID 62: CiceroServer62

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: CiceroServer

Event ID 63: CiceroServer63

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: CiceroServer

Event ID 64: task_064

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`param` UInt32

Event ID 65: IMELocalServer

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: IMELocalServer

Fields #

Name	Description
`guid` GUID

Event ID 66: IMELocalServer66

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: IMELocalServer

Fields #

Name	Description
`guid` GUID

Event ID 67: IMELocalServer67

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: IMELocalServer

Fields #

Name	Description
`guid` GUID

Event ID 68: IMELocalServer68

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: IMELocalServer

Fields #

Name	Description
`guid` GUID

Event ID 69: IMELocalServer69

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: IMELocalServer

Fields #

Name	Description
`guid` GUID

Event ID 70: IMELocalServer70

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: IMELocalServer

Fields #

Name	Description
`guid` GUID

Event ID 71: IMELocalServerStart

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: IMELocalServer
Opcode: Start

Event ID 72: IMELocalServerStop

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: IMELocalServer
Opcode: Stop

Event ID 73: InputProfileActivation

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: InputProfileActivation

Event ID 74: InputProfileActivation74

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: InputProfileActivation

Fields #

Name	Description
`param` UInt32

Event ID 75: InputProfileActivation75

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: InputProfileActivation

Fields #

Name	Description
`guid` GUID
`langid` UInt16

Event ID 76: InputProfileDeactivation

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: InputProfileDeactivation

Event ID 77: InputProfileDeactivation77

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: InputProfileDeactivation

Fields #

Name	Description
`param` UInt32

Event ID 78: InputProfileDeactivation78

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: InputProfileDeactivation

Event ID 79: DocumentFocusChange

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: DocumentFocusChange

Fields #

Name	Description
`DocId` UInt32
`DocThread` UInt32
`GainFocus` Boolean

Event ID 80: DocumentFocusChange80

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: DocumentFocusChange

Fields #

Name	Description
`thread` UInt32
`document` UInt32

Event ID 81: DocumentFocusChange81

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: DocumentFocusChange

Fields #

Name	Description
`thread` UInt32
`document` UInt32

Event ID 82: DocumentFocusChange82

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: DocumentFocusChange

Fields #

Name	Description
`boolean` Boolean

Event ID 83: DocumentContentChange

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: DocumentContentChange

Event ID 84: DocumentContentChange84

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: DocumentContentChange

Fields #

Name	Description
`param` UInt32

Event ID 85: DocumentContentChange85

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: DocumentContentChange

Fields #

Name	Description
`param` UInt32

Event ID 86: DocumentContentChange86

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: DocumentContentChange

Event ID 87: KeyboardEventHandling

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: KeyboardEventHandling

Event ID 88: KeyboardEventHandling88

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: KeyboardEventHandling

Event ID 89: KeyboardEventHandling89

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: KeyboardEventHandling

Fields #

Name	Description
`boolean` Boolean

Event ID 90: KeyboardEventHandling90

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: KeyboardEventHandling

Event ID 91: KeyboardEventHandling91

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: KeyboardEventHandling

Event ID 92: KeyboardEventHandling92

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: KeyboardEventHandling

Event ID 93: KeyboardEventHandling93

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: KeyboardEventHandling

Event ID 94: KeyboardEventHandling94

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: KeyboardEventHandling

Event ID 95: KeyboardEventHandling95

Provider: Microsoft-Windows-TSF-msctf
Channel: Diagnostic
Task: KeyboardEventHandling

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}

Defined in msctf.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · sample captured from a live trace · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · sample captured from a live trace · binary version 10.0.26100.1 · captured 2026-06-02
WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Microsoft-Windows-TSF-msctf registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-TSF-msctf registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)