Microsoft-Windows-WindowsUIImmersive

25 events across 1 channel

Event	Title	Channel
8701	PopupGeneral	Diagnostic
8702	PopupGeneral8702	Diagnostic
8703	PopupGeneral8703	Diagnostic
8704	PopupGeneral8704	Diagnostic
8705	PopupGeneral8705	Diagnostic
8706	PopupGeneral8706	Diagnostic
8711	PopupShowStart	Diagnostic
8712	PopupShowStop	Diagnostic
8713	PopupProgrammaticHideStart	Diagnostic
8714	PopupProgrammaticHideStop	Diagnostic
8715	PopupChangeContentStart	Diagnostic
8716	PopupChangeContentStop	Diagnostic
8717	PopupRepositionStart	Diagnostic
8718	PopupRepositionStart8718	Diagnostic
8719	PopupRepositionStop	Diagnostic
8720	The popup was registered with hwnd (HWND) with flags (Flags) and in process …	Diagnostic
8721	PopupLightDismissStop	Diagnostic
8722	The Popup (HWND) was dismissed because DismissReason.	Diagnostic
8723	PopupLightDismiss8723	Diagnostic
8741	LightDismiss	Diagnostic
8742	LightDismiss8742	Diagnostic
8743	LightDismiss8743	Diagnostic
8744	LightDismiss8744	Diagnostic
8745	LightDismiss8745	Diagnostic
8751	LightDismissOverlay	Diagnostic

Event ID 8701: PopupGeneral

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupGeneral

Event ID 8702: PopupGeneral8702

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupGeneral

Event ID 8703: PopupGeneral8703

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupGeneral

Event ID 8704: PopupGeneral8704

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupGeneral

Event ID 8705: PopupGeneral8705

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupGeneral

Fields #

Name	Description
`CommandID` UInt32

Event ID 8706: PopupGeneral8706

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupGeneral

Event ID 8711: PopupShowStart

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupShow
Opcode: Start

Event ID 8712: PopupShowStop

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupShow
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 8713: PopupProgrammaticHideStart

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupProgrammaticHide
Opcode: Start

Event ID 8714: PopupProgrammaticHideStop

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupProgrammaticHide
Opcode: Stop

Event ID 8715: PopupChangeContentStart

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupChangeContent
Opcode: Start

Event ID 8716: PopupChangeContentStop

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupChangeContent
Opcode: Stop

Event ID 8717: PopupRepositionStart

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupReposition
Opcode: Start

Event ID 8718: PopupRepositionStart8718

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupReposition
Opcode: Start

Event ID 8719: PopupRepositionStop

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupReposition
Opcode: Stop

Event ID 8720: The popup was registered with hwnd (HWND) with flags (Flags) and in process (ProcessID).

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupLightDismiss
Opcode: Start

Description

The popup was registered with hwnd (HWND) with flags (Flags) and in process (ProcessID).

Message #

The popup was registered with hwnd (%1) with flags (%3) and in process (%2).

Fields #

Name	Description
`HWND` Pointer
`ProcessID` HexInt32
`Flags` HexInt32

Event ID 8721: PopupLightDismissStop

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupLightDismiss
Opcode: Stop

Event ID 8722: The Popup (HWND) was dismissed because DismissReason.

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupLightDismiss

Description

The Popup (HWND) was dismissed because DismissReason.

Message #

The Popup (%1) was dismissed because %2.

Fields #

Name	Description
`HWND` Pointer
`DismissReason` UInt32

Event ID 8723: PopupLightDismiss8723

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: PopupLightDismiss

Fields #

Name	Description
`HRESULT` UInt32

Event ID 8741: LightDismiss

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: LightDismiss

Event ID 8742: LightDismiss8742

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: LightDismiss

Fields #

Name	Description
`HWND` Pointer

Event ID 8743: LightDismiss8743

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: LightDismiss

Event ID 8744: LightDismiss8744

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: LightDismiss

Event ID 8745: LightDismiss8745

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: LightDismiss

Event ID 8751: LightDismissOverlay

Provider: Microsoft-Windows-WindowsUIImmersive
Channel: Diagnostic
Task: LightDismissOverlay

Fields #

Name	Description
`Left` Int32
`Top` Int32
`Right` Int32
`Bottom` Int32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 74827cbb-1e0f-45a2-8523-c605866d2f22

Defined in Windows.UI.Immersive.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)