Microsoft-Windows-SmartScreen
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1000 | Application SmartScreen Event | Debug | N | N |
| 1001 | Uri SmartScreen Event | Debug | N | N |
| 1002 | User Decision SmartScreen Event | Debug | N | N |
| 1003 | Telemetry SmartScreen Event | Debug | Y | N |
Event ID 1000: Application SmartScreen Event
#Fields #
| Name | Description |
|---|---|
FilePath UnicodeString | |
FullFileHash UnicodeString | |
AuthenticodeHash UnicodeString | |
AuthenticodeAlgorithm UnicodeString | |
MarkOfTheWeb UnicodeString | |
CallingProcessId UInt32 | Process ID of the process initiating the operation. |
CallingProcessCreationTime UInt64 | |
Sid UnicodeString | |
ActivityId UnicodeString | |
Enforcement UnicodeString | |
Experience UnicodeString |
Event ID 1001: Uri SmartScreen Event
#Fields #
| Name | Description |
|---|---|
Uri UnicodeString | |
IP UnicodeString | |
ReferrerUri UnicodeString | |
ReferrerIP UnicodeString | |
Recommendation UnicodeString | |
HitType UnicodeString | |
NavigationType UnicodeString | |
ProductType UnicodeString | |
CallingProcessId UInt32 | Process ID of the process initiating the operation. |
CallingProcessCreationTime UInt64 | |
Sid UnicodeString | |
ActivityId UnicodeString | |
Enforcement UnicodeString | |
Experience UnicodeString |
Event ID 1002: User Decision SmartScreen Event
#Fields #
| Name | Description |
|---|---|
Action UnicodeString | |
ActivitiyId UnicodeString |
Event ID 1003: Telemetry SmartScreen Event
#Fields #
| Name | Description |
|---|---|
Data UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-SmartScreen",
"guid": "3CB2A168-FE34-4A4E-BDAD-DCF422F34473",
"event_source_name": "",
"event_id": 1003,
"version": 0,
"level": 5,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2026-03-13T21:26:53.616236+00:00",
"event_record_id": 1,
"correlation": {},
"execution": {
"process_id": 3204,
"thread_id": 10796
},
"channel": "Microsoft-Windows-SmartScreen/Debug",
"computer": "LAB-DC01.ludus.domain",
"security": {
"user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
}
},
"event_data": {
"Data_0": {
"$type": "scenario",
"name": "onAllowedZoneCheck"
}
},
"message": ""
}
Example keys not documented in the fields table: Data_0
Provenance
ETW provider GUID 3cb2a168-fe34-4a4e-bdad-dcf422f34473
Defined in smartscreen.exe, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3692, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4202, captured 2026-06-02 — Manifest XML pack, 2.0 MB