detection.wiki

Microsoft-Windows-Privacy-Auditing-CPSS › Event 1002

Event ID 1002 — The User Setting {(Area) (SubArea) (ID)} for user TargetUserSid owned by Component was changed from OldSettingValue to NewSettingValue by ProcessName.

Provider
Microsoft-Windows-Privacy-Auditing-CPSS
Channel
Operational
Level
Informational
Task
ValueChanged

Description

The User Setting {(Area) (SubArea) (ID)} for user TargetUserSid owned by Component was changed from OldSettingValue to NewSettingValue by ProcessName. Justification: Justification.

Message #

The User Setting {(%9) (%10) (%11)} for user %6 owned by %8 was changed from %4 to %5 by %2. Justification: %12.

Fields #

NameDescription
ProcessUserSid UnicodeString—
ProcessName UnicodeString—
ProcessAppPackageFullName UnicodeString—
OldSettingValue UnicodeString—
NewSettingValue UnicodeString—
TargetUserSid UnicodeString—
HResult HexInt32—
Component UnicodeString—
Area UnicodeString—
SubArea UnicodeString—
ID UnicodeString—
Justification UnicodeString2. Justification.
TestCode Boolean—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Privacy-Auditing-CPSS",
    "guid": "15F4CD44-CA53-5422-DB17-4E76821B5A69",
    "event_source_name": "",
    "event_id": 1002,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": 9223372036854775810,
    "time_created": "2023-11-05T22:28:55.211293+00:00",
    "event_record_id": 98,
    "correlation": {},
    "execution": {
      "process_id": 2748,
      "thread_id": 2616
    },
    "channel": "Microsoft-Windows-Privacy-Auditing/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ProcessUserSid": "S-1-5-18",
    "ProcessName": "svchost.exe",
    "ProcessAppPackageFullName": "",
    "OldSettingValue": "NULL",
    "NewSettingValue": "2",
    "TargetUserSid": "S-1-5-21-1992711665-1655669231-58201500-1000",
    "HResult": "0x0",
    "Component": "TailoredExperiencesWithDiagnosticDataEnabled",
    "Area": "Area",
    "SubArea": "SubArea",
    "ID": "ID",
    "Justification": "Projection overrode CPSS value",
    "TestCode": false
  },
  "message": ""
}

References #