mirror of
https://github.com/repnz/etw-providers-docs
synced 2026-06-08 17:06:44 +00:00
repnz
65 lines
3.9 KiB
XML
65 lines
3.9 KiB
XML
<instrumentationManifest xmlns="http://schemas.microsoft.com/win/2004/08/events">
|
|
<instrumentation xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events">
|
|
<events>
|
|
<provider name="Microsoft-Windows-Kernel-Audit-API-Calls" guid="{e02a841c-75a3-4fa7-afc8-ae09cf9b7f23}" resourceFileName="Microsoft-Windows-Kernel-Audit-API-Calls" messageFileName="Microsoft-Windows-Kernel-Audit-API-Calls" symbol="MicrosoftWindowsKernelAuditAPICalls" source="Xml" >
|
|
<keywords>
|
|
</keywords>
|
|
<tasks>
|
|
<task name="task_0" message="$(string.task_task_0)" value="0"/>
|
|
</tasks>
|
|
<events>
|
|
<event value="1" symbol="KERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINE" version="0" task="task_0" level="win:Informational" template="KERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINEArgs"/>
|
|
<event value="2" symbol="KERNEL_AUDIT_API_TERMINATEPROCESS" version="0" task="task_0" level="win:Informational" template="KERNEL_AUDIT_API_TERMINATEPROCESSArgs"/>
|
|
<event value="3" symbol="KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT" version="0" task="task_0" level="win:Informational" template="KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECTArgs"/>
|
|
<event value="4" symbol="KERNEL_AUDIT_API_SETCONTEXTTHREAD" version="0" task="task_0" level="win:Informational" template="KERNEL_AUDIT_API_SETCONTEXTTHREADArgs"/>
|
|
<event value="5" symbol="KERNEL_AUDIT_API_OPENPROCESS" version="0" task="task_0" level="win:Informational" template="KERNEL_AUDIT_API_OPENPROCESSArgs"/>
|
|
<event value="6" symbol="KERNEL_AUDIT_API_OPENTHREAD" version="0" task="task_0" level="win:Informational" template="KERNEL_AUDIT_API_OPENTHREADArgs"/>
|
|
<event value="7" symbol="KERNEL_AUDIT_API_IOREGISTERLASTCHANCESHUTDOWNNOTIFICATION" version="0" task="task_0" level="win:Informational" template="KERNEL_AUDIT_API_IOREGISTERSHUTDOWNNOTIFICATIONArgs"/>
|
|
<event value="8" symbol="KERNEL_AUDIT_API_IOREGISTERSHUTDOWNNOTIFICATION" version="0" task="task_0" level="win:Informational" template="KERNEL_AUDIT_API_IOREGISTERSHUTDOWNNOTIFICATIONArgs"/>
|
|
</events>
|
|
<templates>
|
|
<template tid="KERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINEArgs">
|
|
<data name="NotifyRoutineAddress" inType="win:Pointer"/>
|
|
<data name="ReturnCode" inType="win:UInt32"/>
|
|
</template>
|
|
<template tid="KERNEL_AUDIT_API_TERMINATEPROCESSArgs">
|
|
<data name="TargetProcessId" inType="win:UInt32"/>
|
|
<data name="ReturnCode" inType="win:UInt32"/>
|
|
</template>
|
|
<template tid="KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECTArgs">
|
|
<data name="LinkSourceName" inType="win:UnicodeString"/>
|
|
<data name="LinkTargetName" inType="win:UnicodeString"/>
|
|
<data name="DesiredAccess" inType="win:UInt32"/>
|
|
<data name="ReturnCode" inType="win:UInt32"/>
|
|
</template>
|
|
<template tid="KERNEL_AUDIT_API_SETCONTEXTTHREADArgs">
|
|
<data name="ReturnCode" inType="win:UInt32"/>
|
|
</template>
|
|
<template tid="KERNEL_AUDIT_API_OPENPROCESSArgs">
|
|
<data name="TargetProcessId" inType="win:UInt32"/>
|
|
<data name="DesiredAccess" inType="win:UInt32"/>
|
|
<data name="ReturnCode" inType="win:UInt32"/>
|
|
</template>
|
|
<template tid="KERNEL_AUDIT_API_OPENTHREADArgs">
|
|
<data name="TargetProcessId" inType="win:UInt32"/>
|
|
<data name="TargetThreatId" inType="win:UInt32"/>
|
|
<data name="DesiredAccess" inType="win:UInt32"/>
|
|
<data name="ReturnCode" inType="win:UInt32"/>
|
|
</template>
|
|
<template tid="KERNEL_AUDIT_API_IOREGISTERSHUTDOWNNOTIFICATIONArgs">
|
|
<data name="DriverName" inType="win:UnicodeString"/>
|
|
<data name="ReturnCode" inType="win:UInt32"/>
|
|
</template>
|
|
</templates>
|
|
</provider>
|
|
</events>
|
|
</instrumentation>
|
|
<localization>
|
|
<resources culture="en-US">
|
|
<stringTable>
|
|
<string id="task_task_0" value="task_0"/>
|
|
</stringTable>
|
|
</resources>
|
|
</localization>
|
|
</instrumentationManifest>
|