detection.wiki

Microsoft-Windows-Security-SPP-UX-GC

EventTitleChannelSampleRule
100Security_SPP_UX_GC_MainDisplayStartAnalyticNN
101Security_SPP_UX_GC_MainDisplayStopAnalyticNN

Event ID 100: Security_SPP_UX_GC_MainDisplayStart

#
Channel
Analytic
Task
Security_SPP_UX_GC_MainDisplay
Opcode
Start

Event ID 101: Security_SPP_UX_GC_MainDisplayStop

#
Channel
Analytic
Task
Security_SPP_UX_GC_MainDisplay
Opcode
Stop

Provenance

ETW provider GUID bbbdd6a3-f35e-449b-a471-4d830c8eda1f

Defined in sppcommdlg.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB