detection.wiki

Microsoft-Windows-AppModel-Exec › Event 713

Event ID 713 — Background Access State For Package Modified CallerUserSid = CallerUserSid CallerProcessName = CallerProcessName CallerPackageFamilyName = CallerPackageFamilyName OldConsentValue = OldConsentValue ...

Provider
Microsoft-Windows-AppModel-Exec
Channel
Operational
Level
Informational
Task
BackgroundAccessPackageStateChanged

Message #

Background Access State For Package Modified CallerUserSid = %1 CallerProcessName = %2 CallerPackageFamilyName = %3              OldConsentValue = %4 NewConsentValue = %5 IsSetByHigherAuthority = %6 EffectiveConsentValue = %7 TargetUserSid = %8              TargetPackageFamilyName = %9 HRESULT = %10

Fields #

NameDescription
CallerUserSid UnicodeString—
CallerProcessName UnicodeString—
CallerPackageFamilyName UnicodeString—
OldConsentValue UInt32—
NewConsentValue UInt32—
IsSetByHigherAuthority Boolean—
EffectiveConsentValue UInt32—
TargetUserSid UnicodeString—
TargetPackageFamilyName UnicodeString—
HRESULT UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppModel-Exec",
    "guid": "EB65A492-86C0-406A-BACE-9912D595BD69",
    "event_source_name": "",
    "event_id": 713,
    "version": 0,
    "level": 4,
    "task": 73,
    "opcode": 0,
    "keywords": 9223407221226864640,
    "time_created": "2023-11-05T22:56:17.831960+00:00",
    "event_record_id": 163,
    "correlation": {},
    "execution": {
      "process_id": 6212,
      "thread_id": 10044
    },
    "channel": "Microsoft-Windows-Privacy-Auditing/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "CallerUserSid": "S-1-5-21-1992711665-1655669231-58201500-1000",
    "CallerProcessName": "Widgets.exe",
    "CallerPackageFamilyName": "MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy",
    "OldConsentValue": 0,
    "NewConsentValue": 8,
    "IsSetByHigherAuthority": false,
    "EffectiveConsentValue": 8,
    "TargetUserSid": "S-1-5-21-1992711665-1655669231-58201500-1000",
    "TargetPackageFamilyName": "MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy",
    "HRESULT": 0
  },
  "message": ""
}

References #