detection.wiki

Microsoft-Windows-PushNotifications-Platform › Event 1268

Event ID 1268 — WNP Transport Layer received command: Verb, Trid: TrID, Namespace: Namespace, CV: CorrelationVector containing Bytes bytes of payload only.

Provider
Microsoft-Windows-PushNotifications-Platform
Channel
Operational
Level
Verbose
Opcode
Info

Description

WNP Transport Layer received command: Verb, Trid: TrID, Namespace: Namespace, CV: CorrelationVector containing Bytes bytes of payload only. However, full payload including header is: Payload. IsLongRunning: ConnectionType.

Message #

WNP Transport Layer received command: %1, Trid: %2, Namespace: %3, CV: %4 containing %5 bytes of payload only. However, full payload including header is: %6. IsLongRunning: %7.

Fields #

NameDescription
Verb AnsiStringWNP Transport Layer received command.
TrID UInt32—
Namespace AnsiString—
CorrelationVector AnsiString—
Bytes UInt32—
Payload Binary5 bytes of payload only. However, full payload including header is.
ConnectionType UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1268,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036959633408,
    "time_created": "2023-11-06T01:49:11.384651+00:00",
    "event_record_id": 2776,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Verb": "PNG",
    "TrID": 19,
    "Namespace": "CON",
    "CorrelationVector": "vfP4YmNyxkSgHVIt.19.0",
    "Bytes": 126,
    "Payload": "504E4720313920434F4E003132360D0A4D532D43563A2076665034596D4E79786B5367485649742E31392E300D0A0D0A3C70696E672D726573706F6E73653E3C776169743E34333C2F776169743E3C636F6E6E656374696F6E2D7374617475733E436F6E6E65637465643C2F636F6E6E656374696F6E2D7374617475733E",
    "ConnectionType": 1
  },
  "message": ""
}

References #