detection.wiki

Microsoft-Antimalware-UacScan

EventTitleChannelSampleRule
1201UacScanDebugNN

Event ID 1201: UacScan

#
Channel
Debug

Fields #

NameDescription
requestorProcessId UInt32
uacRequestType UInt8
uacTrustState UInt8
autoElevateRequest Boolean
exeApplicationName UnicodeString
exeCommandLine UnicodeString
exeDllParam UnicodeString
comServerBinary UnicodeString
comRequestor UnicodeString
comClsid GUID

Provenance

ETW provider GUID d37e7910-79c8-57c4-da77-52bb646364cd

Defined in amsi.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB