detection.wiki

Microsoft-Windows-PushNotifications-Platform › Event 1267

Event ID 1267 — WNP Transport Layer sent command: Verb, Trid: TrID, Namespace: Namespace, CV: CorrelationVector containing Bytes bytes of payload only.

Provider
Microsoft-Windows-PushNotifications-Platform
Channel
Operational
Level
Verbose
Opcode
Info

Description

WNP Transport Layer sent command: Verb, Trid: TrID, Namespace: Namespace, CV: CorrelationVector containing Bytes bytes of payload only. However, full payload including header is: Payload. IsLongRunning: ConnectionType.

Message #

WNP Transport Layer sent command: %1, Trid: %2, Namespace: %3, CV: %4 containing %5 bytes of payload only. However, full payload including header is: %6. IsLongRunning: %7.

Fields #

NameDescription
Verb AnsiStringWNP Transport Layer sent command.
TrID UInt32—
Namespace AnsiString—
CorrelationVector AnsiString—
Bytes UInt32—
Payload Binary5 bytes of payload only. However, full payload including header is.
ConnectionType UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1267,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036959633408,
    "time_created": "2023-11-06T01:49:11.345599+00:00",
    "event_record_id": 2774,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Verb": "PNG",
    "TrID": 19,
    "Namespace": "CON",
    "CorrelationVector": "vfP4YmNyxkSgHVIt.19",
    "Bytes": 72,
    "Payload": "504E4720313920434F4E2035370D0A4D532D43563A2076665034596D4E79786B5367485649742E31390D0A436F6E746578743A20336635303563336636353833666465640D0A0D0A",
    "ConnectionType": 1
  },
  "message": ""
}

References #