detection.wiki

Microsoft-Windows-PushNotifications-Platform › Event 3001

Event ID 3001 — Tile session creation is finished for ProcessName from endpoint Endpoint with result Error, and SessionId is assigned as session id.

Provider
Microsoft-Windows-PushNotifications-Platform
Channel
Operational
Level
Informational
Task
TileSessionCreate
Opcode
Stop

Description

Tile session creation is finished for ProcessName from endpoint Endpoint with result Error, and SessionId is assigned as session id. Queued Closes = QueuedTileCloses, Queued Cleanups = QueuedTileCleanups.

Message #

Tile session creation is finished for %4 from endpoint %1 with result %3, and %2 is assigned as session id. Queued Closes = %5, Queued Cleanups = %6

Fields #

NameDescription
Endpoint Pointer—
SessionId UInt32—
Error Int32—
ProcessName UnicodeString—
QueuedTileCloses Int32—
QueuedTileCleanups Int32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3001,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 2,
    "keywords": 9223372036854777856,
    "time_created": "2023-11-05T23:54:29.275653+00:00",
    "event_record_id": 2734,
    "correlation": {},
    "execution": {
      "process_id": 4304,
      "thread_id": 7872
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "Endpoint": "0x12fc9788eb8",
    "SessionId": 5,
    "Error": 0,
    "ProcessName": "C:\\Windows\\explorer.exe",
    "QueuedTileCloses": 0,
    "QueuedTileCleanups": 0
  },
  "message": ""
}

References #