keywords.md

March 7, 2023 ยท View on GitHub

Event log 'Keywords' p1

keywords: (SystemPropertiesType) Element - A bitmask of the keywords defined in the event
Defines a list of keywords that categorize events (type="HexInt64Type").

Patterns: The HexInt64Type simple type is a string that is restricted by the following pattern: 0[xX][0-9A-Fa-f]{1,16}
The value can contain from one to sixteen hexadecimal characters (for example, 0xa or 0xac7bd361004fe190).

keywords property: The keywords for an event are used to group the event with other similar events based on the usage of the events.
Each keyword is a bit in a 64-bit mask.
Predefined bit values and reserved bits occupy the top 16 positions of this mask, leaving the manifest to use any bits between 0x0000000000000001 and 0x0000800000000000.
The standard event keywords are defined in the StandardEventKeywords enumeration.

  • PowerShell script to list all unique event log 'keywords'

     try{$event = @((Get-WinEvent -Listprovider *  -ErrorAction SilentlyContinue ).events.keywords) }
 catch{$event=$null}
 
 $keywords = @(foreach($i in $event) {
      
      if($i -ne $null){           
                 [PSCustomObject]@{
                                     Name = $i.name
                                     ValueHEX = "0x"+'{0:x16}'-f $i.value
                                     ValueDEC= $i.value
                                     DisplayName = $i.displayname
                                 }
                               }
                             }
                           ) 
 $keywords = ($keywords|sort-object -Property ValueDEC -unique) 
 $keywords |format-table -autosize
 $keywords |Export-Csv -path "$($env:userprofile)\desktop\keymain.csv" -Delimiter ","

  • Output in CSV

  • Output:

    NameKeyword (HEX)Keyword (DEC)Display Name
    Base0x00000000000000011
    Performance0x00000000000000022Performance
    Tasks0x00000000000000044
    Trigger0x00000000000000088
    ETW_KEYWORD_SESSION0x000000000000001016Session
    Warning0x000000000000002032Warning
    WFTracking0x000000000000004064WF Tracking
    ut:TcpipDiagnosis0x0000000000000080128
    USER_LOADER_KEYWORD COMPONENT_ON_DEMAND0x0000000000000100256Windows component on demand.
    DxgKrnl_Power0x0000000000000200512
    RotationManager0x00000000000004001024CUI RotationManager
    StationId0x00000000000008002048StationId
    Rendering0x00000000000010004096
    HWVerifyHub0x00000000000020008192
    PLM0x000000000000400016384Lifetime Manager
    RoutingServices0x000000000000800032768Routing Services
    Shell0x000000000001000065536
    CSM0x0000000000020000131072Crawl Scope Manager
    Streaming0x0000000000040000262144Streaming
    APPXDEPLOYMENTSERVER PERF_KEYWORD0x0000000000080000524288AppXDeploymentServerPerf Keyword
    ExecSelfHostCritical0x00000000001000001048576SelfHost Critical
    ExecDevPlatCircular0x00000000002000002097152DevPlat Circular
    Write0x00000000004000004194304Write request
    tabhydration0x00000000008000008388608
    WFRuntime0x000000000100000016777216Workflow Runtime
    LowMemoryRead0x000000000200000033554432Low memory Read request
    StartupPerf0x000000000400000067108864
    StructuredQuery0x0000000008000000134217728
    ViewManager0x0000000010000000268435456OneCore CUI ViewManager
    animation0x0000000020000000536870912
    IOCTL0x00000000400000001073741824Device I/O control request
    composition_verbose0x00000000800000002147483648
    MessagingPerformance0x00000001000000004294967296CoreMessaging MessagingPerformance
    Keyword.RECEIVE0x00000002000000008589934592RECEIVE
    debug0x000000040000000017179869184Debug events
    DCompDetails0x000000080000000034359738368
    CommsService0x000000100000000068719476736CommsService
    ut:Authentication0x0000002000000000137438953472
    Warning0x0000004000000000274877906944
    StateTransition0x0000008000000000549755813888
    ut:Dropped0x00000100000000001099511627776
    ut:PiiPresent0x00000200000000002199023255552
    WININET_KEYWORD_PACKET0x00000400000000004398046511104Flagged on all WinINet events dealing with packet capture
    SelfHostError0x00000800000000008796093022208CoreMessaging SelfHostError
    Messages0x000010000000000017592186044416
    ut:StateTransition0x000020000000000035184372088832
    ms:Measures0x000040000000000070368744177664
    WinRTCaptureEngine0x0000800000000000140737488355328
    win:ResponseTime0x0001000000000000281474976710656Response Time
    win:ReservedKeyword490x0002000000000000562949953421312
    win:WDIDiag0x00040000000000001125899906842624WDI Diag
    win:SQM0x00080000000000002251799813685248SQM
    win:AuditFailure0x00100000000000004503599627370496Audit Failure
    win:AuditSuccess0x00200000000000009007199254740992Audit Success
    win:EventlogClassic0x008000000000000036028797018963968Classic
    0x010000000000000072057594037927936
    0x0200000000000000144115188075855872
    0x0400000000000000288230376151711744
    0x0800000000000000576460752303423488
    0x10000000000000001152921504606846976
    0x20000000000000002305843009213693952
    0x40000000000000004611686018427387904
    0x8000000000000000-9223372036854775808

  • Known keywords ( source1)

    NameKeyword (HEX)Keyword (DEC)Display Name
    0x0000000000010000Shell
    0x0000000000020000Properties
    0x0000000000040000FileClassStoreAndIconCache
    0x0000000000080000Controls
    0x0000000000100000APICalls'
    0x0000000000200000InternetExplorer
    0x0000000000400000ShutdownUX
    0x0000000000800000CopyEngine
    0x0000000001000000Tasks
    0x0000000002000000WDI
    0x0000000004000000StartupPerf
    0x0000000008000000StructuredQuery
    0x0008000000000000win:SQM
    0x8000000000000000Microsoft-Windows-Shell-Core/Diagnostic

  • Known keywords ( source2)

    NameKeyword (HEX)Keyword (DEC)Display Name
    win:AnyKeyword0x0000000000000000
    0x0000000000010000Shell
    0x0000000000020000Properties
    0x0000000000040000FileClassStoreAndIconCache
    0x0000000000080000Controls
    0x0000000000100000APICalls
    0x0000000000200000InternetExplorer
    0x0000000000400000ShutdownUX
    0x0000000000800000CopyEngine
    0x0000000001000000Tasks
    0x0000000002000000WDI
    0x0000000004000000StartupPerf
    0x0000000008000000StructuredQuery
    win:Reserved0x0001000000000000
    win:WDIContext0x0002000000000000
    win:WDIDiag0x0004000000000000
    win:SQM0x0008000000000000
    win:AuditFailure0x0010000000000000
    win:AuditSuccess0x0020000000000000
    win:CorrelationHint0x0040000000000000
    win:EventlogClassic0x0080000000000000Classic
    win:ReservedKeyword560x0100000000000000
    win:ReservedKeyword570x0200000000000000
    win:ReservedKeyword580x0400000000000000
    win:ReservedKeyword590x0800000000000000
    win:ReservedKeyword600x1000000000000000
    win:ReservedKeyword610x2000000000000000
    win:ReservedKeyword620x4000000000000000
    win:ReservedKeyword630x8000000000000000Microsoft-Windows-Shell-Core/Diagnostic

Next Page: Continues to keywords2