detection.wiki

Microsoft-Windows-Privacy-Auditing-CPSS › Event 1000

Event ID 1000 — The System Setting {(Area) (SubArea) (ID)} owned by Component was changed from OldSettingValue to NewSettingValue by ProcessName.

Provider
Microsoft-Windows-Privacy-Auditing-CPSS
Channel
Operational
Level
Informational
Task
ValueChanged

Description

The System Setting {(Area) (SubArea) (ID)} owned by Component was changed from OldSettingValue to NewSettingValue by ProcessName. Justification: Justification.

Message #

The System Setting {(%9) (%10) (%11)} owned by %8 was changed from %4 to %5 by %2. Justification: %12.

Fields #

NameDescription
ProcessUserSid UnicodeString—
ProcessName UnicodeString—
ProcessAppPackageFullName UnicodeString—
OldSettingValue UnicodeString—
NewSettingValue UnicodeString—
TargetUserSid UnicodeString—
HResult HexInt32—
Component UnicodeString—
Area UnicodeString—
SubArea UnicodeString—
ID UnicodeString—
Justification UnicodeString2. Justification.
TestCode Boolean—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Privacy-Auditing-CPSS",
    "guid": "15F4CD44-CA53-5422-DB17-4E76821B5A69",
    "event_source_name": "",
    "event_id": 1000,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": 9223372036854775809,
    "time_created": "2023-10-26T04:17:21.725904+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 2748,
      "thread_id": 2976
    },
    "channel": "Microsoft-Windows-Privacy-Auditing/Operational",
    "computer": "WIN-OQ6R0RVA4NF",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ProcessUserSid": "S-1-5-18",
    "ProcessName": "svchost.exe",
    "ProcessAppPackageFullName": "",
    "OldSettingValue": "NULL",
    "NewSettingValue": "false",
    "TargetUserSid": "",
    "HResult": "0x0",
    "Component": "TailoredExperiencesWithDiagnosticDataEnabled",
    "Area": "Area",
    "SubArea": "SubArea",
    "ID": "ID",
    "Justification": "Projection overrode CPSS value",
    "TestCode": false
  },
  "message": ""
}

References #