detection.wiki

Microsoft-Windows-PushNotifications-Platform › Event 3007

Event ID 3007 — Toast session creation is finished for ProcessName from endpoint Endpoint with result Error, and SessionId is assigned as session id.

Provider
Microsoft-Windows-PushNotifications-Platform
Channel
Operational
Level
Informational
Task
ToastSessionCreate
Opcode
Stop

Description

Toast session creation is finished for ProcessName from endpoint Endpoint with result Error, and SessionId is assigned as session id.

Message #

Toast session creation is finished for %4 from endpoint %1 with result %3, and %2 is assigned as session id.

Fields #

NameDescription
Endpoint Pointer—
SessionId UInt32—
Error Int32—
ProcessName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3007,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 2,
    "keywords": 9223372036854777856,
    "time_created": "2023-11-05T22:32:25.705164+00:00",
    "event_record_id": 2393,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0002-1D4E-DBE43710DA01"
    },
    "execution": {
      "process_id": 4304,
      "thread_id": 4488
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "Endpoint": "0x12fc8ff4f88",
    "SessionId": 1,
    "Error": 0,
    "ProcessName": "C:\\Windows\\System32\\svchost.exe"
  },
  "message": ""
}

References #