detection.wiki

Application-Addon-Event-Provider

EventTitleChannelSampleRule
1An add-on has been enabled.ApplicationNN
2An add-on has been disabled.ApplicationNN

Event ID 1: An add-on has been enabled.

#
Channel
Application
Task
EnableAdd_on
Opcode
Start

Description

An add-on has been enabled. Application: Application. Add-on: AddonName. Publisher: Publisher. Version:Version.

Message #

An add-on has been enabled. Application: %1. Add-on: %2. Publisher: %3. Version:%4

Fields #

NameDescription
Application UnicodeString
AddonName UnicodeString
Publisher UnicodeString
Version UnicodeString

Event ID 2: An add-on has been disabled.

#
Channel
Application
Task
DisableAdd_on
Opcode
Stop

Description

An add-on has been disabled. Application: Application. Add-on: AddonName. Publisher: Publisher. Version:Version.

Message #

An add-on has been disabled. Application: %1. Add-on: %2. Publisher: %3. Version:%4

Fields #

NameDescription
Application UnicodeString
AddonName UnicodeString
Publisher UnicodeString
Version UnicodeString

Provenance

ETW provider GUID a83fa99f-c356-4ded-9fd6-5a5eb8546d68

Defined in ieframe.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 11.00.20348.3207, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 11.00.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB