detection.wiki

Microsoft-Windows-WinINet-Config

1 events across 1 channel

EventTitleChannelSample
5600task_0ProxyConfigChangedY

Event ID 5600: task_0

#
Provider
Microsoft-Windows-WinINet-Config
Channel
ProxyConfigChanged
Level
Informational

Fields #

NameDescription
fAutoDetect Boolean
pwszAutoConfigUrl UnicodeString
pwszProxy UnicodeString
pwszProxyBypass UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet-Config",
    "guid": "{5402E5EA-1BDD-4390-82BE-E108F1E634F5}",
    "event_source_name": "",
    "event_id": 5600,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-28T11:13:09.6738908+00:00",
    "event_record_id": 3,
    "correlation": {
      "ActivityID": "{A4B382AC-0054-0000-94D6-0100B0080000}"
    },
    "execution": {
      "process_id": 2224,
      "thread_id": 2284
    },
    "channel": "Microsoft-Windows-WinINet-Config/ProxyConfigChanged",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "fAutoDetect": "true",
    "pwszAutoConfigUrl": "",
    "pwszProxy": "",
    "pwszProxyBypass": ""
  },
  "message": ""
}

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 5402e5ea-1bdd-4390-82be-e108f1e634f5

Defined in winhttp.dll, which carries the event manifest.

Observed on:

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
  • Win11-26200.6584, schema read from the registered manifest, binary version 11.00.26100.1, captured 2026-06-02

Downloads