detection.wiki

Microsoft-AppV-ServiceLog

EventTitleChannelSampleRule
1stringValue1.DebugNN
2WString1.DebugNN
3Message [Function; Line].DebugNN

Event ID 1: stringValue1.

#
Channel
Debug

Message #

%1

Fields #

NameDescription
stringValue1 UnicodeString

Event ID 2: WString1.

#
Channel
Debug
Task
DebugAppVClient
Opcode
AppVClientService

Message #

%1

Fields #

NameDescription
WString1 UnicodeString

Event ID 3: Message [Function; Line].

#
Channel
Debug
Task
DebugAppVClient
Opcode
AppVClientService

Message #

%1 [%2; %3]

Fields #

NameDescription
Message UnicodeString
Function UnicodeString
Line UInt32

Provenance

ETW provider GUID 9cc69d1c-7917-4acd-8066-6bf8b63e551b

Defined in AppvClientEventLog.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB