detection.wiki

Microsoft-Windows-Compat-Appraiser

EventTitleChannelSampleRule
1Information from: SourceLine:Information_from SourceFile FunctionName.AnalyticNN
2Error HResult from: SourceFile:SourceLine FunctionName Message.AnalyticNN
3Message.OperationalNN

Event ID 1: Information from: SourceLine:Information_from SourceFile FunctionName.

#
Channel
Analytic

Description

Information from.

Message #

Information from:
%2:%1
%3

%4

Fields #

NameDescription
Information_from[Information from] 2.
SourceLine UInt32
SourceFile AnsiString
FunctionName AnsiString
Message AnsiString

Event ID 2: Error HResult from: SourceFile:SourceLine FunctionName Message.

#
Channel
Analytic

Description

Error HResult from.

Message #

Error %4 from:
%2:%1
%3

%5

Fields #

NameDescription
SourceLine UInt32
SourceFile AnsiString
FunctionName AnsiString
HResult UInt32
Message AnsiString

Event ID 3: Message.

#
Channel
Operational

Message #

%1

Fields #

NameDescription
Message AnsiString

Provenance

ETW provider GUID 442c11c5-304b-45a4-ae73-dc2194c4e876

Defined in appraiser.dll, which carries the event manifest.