detection.wiki

Microsoft-Windows-SetupPlatform

7 events across 2 channels

Event IDTitleChannel
1001Start operation: Start_operation, Operation.Analytic
1002Stop operation: Stop_operation, Operation.Analytic
1003Online gather starts: Online_gather_starts, OfflineWinDir.Analytic
1004Online gather stops: Online_gather_stops, OfflineWinDir.Analytic
1005Offline gather startsAnalytic
1006Offline gather stopsAnalytic
2005New Setup informationSystem

Event ID 1001 — Start operation: Start_operation, Operation.

Provider
Microsoft-Windows-SetupPlatform
Channel
Analytic
Task
Runoperation
Opcode
Start

Description

Start operation: Start_operation, Operation.

Message #

Start operation: %1, %2

Fields #

NameDescription
Start_operation—
Operation UnicodeString—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
ErrorCode UInt32—

Event ID 1002 — Stop operation: Stop_operation, Operation.

Provider
Microsoft-Windows-SetupPlatform
Channel
Analytic
Task
Runoperation
Opcode
Stop

Description

Stop operation: Stop_operation, Operation.

Message #

Stop operation: %1, %2

Fields #

NameDescription
Stop_operation—
Operation UnicodeString—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
ErrorCode UInt32—

Event ID 1003 — Online gather starts: Online_gather_starts, OfflineWinDir.

Provider
Microsoft-Windows-SetupPlatform
Channel
Analytic
Task
Onlinegather
Opcode
Start

Description

Online gather starts: Online_gather_starts, OfflineWinDir.

Message #

Online gather starts: %1, %2

Fields #

NameDescription
Online_gather_starts—
OfflineWinDir UnicodeString—
MachineSpecific UInt32—

Event ID 1004 — Online gather stops: Online_gather_stops, OfflineWinDir.

Provider
Microsoft-Windows-SetupPlatform
Channel
Analytic
Task
Onlinegather
Opcode
Stop

Description

Online gather stops: Online_gather_stops, OfflineWinDir.

Message #

Online gather stops: %1, %2

Fields #

NameDescription
Online_gather_stops—
OfflineWinDir UnicodeString—
MachineSpecific UInt32—

Event ID 1005 — Offline gather starts

Provider
Microsoft-Windows-SetupPlatform
Channel
Analytic
Task
Offlinegather
Opcode
Start

Description

Offline gather starts.

Message #

Offline gather starts

Event ID 1006 — Offline gather stops

Provider
Microsoft-Windows-SetupPlatform
Channel
Analytic
Task
Offlinegather
Opcode
Stop

Description

Offline gather stops.

Message #

Offline gather stops

Event ID 2005 — New Setup information

Provider
Microsoft-Windows-SetupPlatform
Channel
System
Task
InstallWindowsTask

Description

New Setup information.

Message #

New Setup information

Fields #

NameDescription
Installation choice UInt32—
Host OS Major version UInt32—
Host OS Minor version UInt32—
Host OS Build number UInt32—
Host OS Service pack major number UInt32—
Host OS Service pack minor number UInt32—
Installationchoice UInt32—
HostOSMajorversion UInt32—
HostOSMinorversion UInt32—
HostOSBuildnumber UInt32—
HostOSServicepackmajornumber UInt32—
HostOSServicepackminornumber UInt32—