detection.wiki

Microsoft-Windows-AppxPackagingOM › Event 164

Event ID 164 — The app bundle signature was validated for core content of the app bundle published by subjectName.

Provider
Microsoft-Windows-AppxPackagingOM
Channel
Operational
Level
Informational
Task
DigitalSignature
Opcode
Verifying

Description

The app bundle signature was validated for core content of the app bundle published by subjectName. App packages won't be validated until they are read.

Message #

The app bundle signature was validated for core content of the app bundle published by %1. App packages won't be validated until they are read.

Fields #

NameDescription
subjectName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppxPackagingOM",
    "guid": "BA723D81-0D0C-4F1E-80C8-54740F508DDF",
    "event_source_name": "",
    "event_id": 164,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 12,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:29:24.843342+00:00",
    "event_record_id": 1759,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0000-8EA5-E7E43710DA01"
    },
    "execution": {
      "process_id": 17796,
      "thread_id": 11380
    },
    "channel": "Microsoft-Windows-AppxPackaging/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "subjectName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"
  },
  "message": ""
}

References #