detection.wiki

Microsoft-Windows-PushNotifications-Platform › Event 3052

Event ID 3052 — Toast with notification tracking id TrackingId is being delivered to AppUserModelId on session SessionId.

Provider
Microsoft-Windows-PushNotifications-Platform
Channel
Operational
Level
Informational
Task
NewCloudNotificationArrival
Opcode
Start

Description

Toast with notification tracking id TrackingId is being delivered to AppUserModelId on session SessionId.

Message #

Toast with notification tracking id %1 is being delivered to %2 on session %3.

Fields #

NameDescription
TrackingId Int32—
AppUserModelId UnicodeString—
SessionId UInt32—
MessageId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3052,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 1,
    "keywords": 9223372039010650115,
    "time_created": "2023-11-05T23:08:15.563064+00:00",
    "event_record_id": 2631,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0002-1D4E-DBE43710DA01"
    },
    "execution": {
      "process_id": 4304,
      "thread_id": 2676
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "TrackingId": 2,
    "AppUserModelId": "Windows.SystemToast.StartupApp",
    "SessionId": 1,
    "MessageId": "84982492-82D7-4F7D-B9DA-5695C011C30E"
  },
  "message": ""
}

References #