application.json

{
  "dataset": {
    "name": "EID Quick Reference - Application",
    "version": "1.9.0",
    "generatedAt": "2026-05-10T00:00:00Z",
    "id": "https://raw.githubusercontent.com/zerber0s/windows-eid-data/main/application.json",
    "schema": "https://raw.githubusercontent.com/zerber0s/windows-eid-data/main/schema.json",
    "license": {
      "name": "Creative Commons Attribution 4.0 International",
      "spdx": "CC-BY-4.0",
      "notice": "Event descriptions are paraphrased summaries written for this dataset. Source links point to authoritative references."
    },
    "sources": [
      {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/",
        "type": "primary"
      }
    ]
  },
  "entries": [
    {
      "id": 1000,
      "log": "Application",
      "provider": "Application Error",
      "channel": "Application",
      "level": "Error",
      "title": "Application Error",
      "summary": "Application crashed.",
      "details": "Generated when an application crashes. Records the faulting application name, faulting module name, exception code, and faulting module base address. ExceptionCode 0xc0000005 (access violation) is the most common crash type; 0xc000001d (illegal instruction) may indicate shellcode or ROP chain execution. A faulting module name of UNKNOWN or an offset far outside a known module's address range can indicate exploitation.",
      "category": "Application Crash",
      "tags": [
        "crash",
        "application-error",
        "exploit-detection"
      ],
      "relatedEventIds": [
        {
          "id": 1001,
          "log": "Application"
        },
        {
          "id": 1002,
          "log": "Application"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1203",
          "techniqueName": "Exploitation for Client Execution",
          "tactics": [
            {
              "tacticId": "TA0002",
              "tacticName": "Execution"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "FaultingModuleName of UNKNOWN or ntdll.dll with an unusual offset may indicate shellcode execution",
          "ExceptionCode 0xc000001d (illegal instruction) or 0xc0000409 (stack buffer overrun) are higher-fidelity exploitation indicators than 0xc0000005",
          "Check FaultingApplicationName against the known software inventory — crashes in unexpected processes warrant investigation",
          "Correlate with EID 1001 for WER bucket data and Security EID 4688 for process creation context"
        ],
        "commonFalsePositives": [
          "Legitimate software bugs causing crashes",
          "Third-party applications crashing due to OS compatibility issues or missing dependencies"
        ]
      },
      "keyFields": [
        {
          "name": "FaultingApplicationName",
          "xpath": "EventData/Data[@Name='FaultingApplicationName']",
          "description": "Name of the application that crashed"
        },
        {
          "name": "FaultingModuleName",
          "xpath": "EventData/Data[@Name='FaultingModuleName']",
          "description": "Module responsible for the crash; UNKNOWN may indicate exploitation"
        },
        {
          "name": "ExceptionCode",
          "xpath": "EventData/Data[@Name='ExceptionCode']",
          "description": "Exception type (e.g., 0xc0000005 = access violation, 0xc000001d = illegal instruction)"
        },
        {
          "name": "FaultingModuleBaseAddress",
          "xpath": "EventData/Data[@Name='FaultingModuleBaseAddress']",
          "description": "Base address of the faulting module"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/wer/windows-error-reporting"
      },
      "volumeIndicator": "medium",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-04-02"
    },
    {
      "id": 1001,
      "log": "Application",
      "provider": "Windows Error Reporting",
      "channel": "Application",
      "level": "Information",
      "title": "Windows Error Reporting",
      "summary": "WER fault bucket recorded.",
      "details": "Generated by Windows Error Reporting following a crash (EID 1000) or hang (EID 1002). Contains the fault BucketId and problem signature fields (P1-P8) which identify the crash type and faulting component. BucketId can be used to identify identical crashes across multiple systems. FaultBucketType distinguishes crash bucket types. Typically logged a few seconds after the triggering event.",
      "category": "Application Crash",
      "tags": [
        "crash",
        "wer",
        "application-error"
      ],
      "relatedEventIds": [
        {
          "id": 1000,
          "log": "Application"
        },
        {
          "id": 1002,
          "log": "Application"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1203",
          "techniqueName": "Exploitation for Client Execution",
          "tactics": [
            {
              "tacticId": "TA0002",
              "tacticName": "Execution"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "BucketId can correlate the same crash signature across multiple hosts — useful for detecting a weaponized file distributed across the environment",
          "P1–P8 signature fields identify the faulting module and exception type — match against EID 1000 for cross-validation",
          "Timing relative to EID 1000 is typically seconds; a gap may indicate a delayed WER report or queued reporting"
        ],
        "commonFalsePositives": [
          "Any legitimate application crash generating a WER report"
        ]
      },
      "keyFields": [
        {
          "name": "BucketId",
          "xpath": "EventData/Data[@Name='BucketId']",
          "description": "Unique hash identifying this crash signature; same BucketId across hosts indicates an identical crash"
        },
        {
          "name": "FaultBucketType",
          "xpath": "EventData/Data[@Name='FaultBucketType']",
          "description": "Type of fault bucket (crash, hang, etc.)"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/wer/windows-error-reporting"
      },
      "volumeIndicator": "medium",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-04-02"
    },
    {
      "id": 1002,
      "log": "Application",
      "provider": "Application Hang",
      "channel": "Application",
      "level": "Error",
      "title": "Application Hang",
      "summary": "Application stopped responding.",
      "details": "Generated when an application stops responding. The HangType field indicates whether the hang was detected by Windows (ghost window timeout) or triggered by the user terminating the process. A process hanging after code injection or payload execution may indicate a stuck or partially executed implant.",
      "category": "Application Crash",
      "tags": [
        "hang",
        "application-error"
      ],
      "relatedEventIds": [
        {
          "id": 1000,
          "log": "Application"
        },
        {
          "id": 1001,
          "log": "Application"
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "HangType distinguishes a Windows-detected ghost window (UI hang) from a user-terminated process — user termination of an unexpected process warrants investigation",
          "A hang in a known-good process (e.g., Word, Excel) immediately after opening a document may indicate exploit attempt",
          "Correlate with Security EID 4688 to check what the hanging process was doing before it became unresponsive"
        ],
        "commonFalsePositives": [
          "Legitimate applications hanging due to resource exhaustion, deadlocks, or network timeouts",
          "Long-running processes being terminated by users after perceived unresponsiveness"
        ]
      },
      "keyFields": [
        {
          "name": "HangingApplicationName",
          "xpath": "EventData/Data[@Name='HangingApplicationName']",
          "description": "Name of the application that stopped responding"
        },
        {
          "name": "HangType",
          "xpath": "EventData/Data[@Name='HangType']",
          "description": "How the hang was detected (ghost window timeout vs. user termination)"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/wer/windows-error-reporting"
      },
      "volumeIndicator": "medium",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-04-02"
    },
    {
      "id": 1023,
      "log": "Application",
      "provider": ".NET Runtime",
      "channel": "Application",
      "level": "Error",
      "title": ".NET Runtime unhandled exception",
      "summary": "The .NET CLR encountered an unhandled exception that terminated the application.",
      "details": "Generated when a .NET application crashes due to an unhandled exception at the CLR level (separate from EID 1000, which is the Windows Application Error record). Records the faulting application name, exception type, message, and the managed stack trace. Malicious .NET-based tools sometimes crash during or after execution, leaving this event as a forensic artifact. The managed stack trace often contains function names or namespace paths that identify the tool. EID 1023 provides more detail than EID 1000 for managed-code crashes.",
      "category": "Application Crash",
      "tags": [
        ".net",
        "clr",
        "crash",
        "execution",
        "reflective-load"
      ],
      "relatedEventIds": [
        {
          "id": 1000,
          "log": "Application"
        },
        {
          "id": 1026,
          "log": "Application"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1620",
          "techniqueName": "Reflective Code Loading",
          "tactics": [
            {
              "tacticId": "TA0005",
              "tacticName": "Stealth"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Review the managed stack trace in the event message for suspicious namespace/class names (e.g., Cobalt Strike artifacts, SharpXxx tool names)",
          "Correlate the faulting process with EID 1 (Sysmon process create) to see parent process and command line",
          "A crash in powershell.exe (LOLBAS Scripts), msbuild.exe, regasm.exe (LOLBAS Binaries), or other LOLBAS tools with a .NET stack trace is a high-priority indicator — these tools are commonly weaponized for in-memory .NET payload execution"
        ],
        "commonFalsePositives": [
          "Legitimate .NET application bugs causing unhandled exceptions",
          "Compatibility issues with .NET framework version mismatches"
        ]
      },
      "keyFields": [
        {
          "name": "ApplicationName",
          "xpath": "EventData/Data[@Name='ApplicationName']",
          "description": "Name of the .NET application that crashed"
        },
        {
          "name": "ExceptionType",
          "xpath": "EventData/Data[@Name='ExceptionType']",
          "description": "Full .NET exception type (e.g., System.BadImageFormatException)"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/dotnet/standard/exceptions/"
      },
      "volumeIndicator": "medium",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-05-10"
    },
    {
      "id": 1026,
      "log": "Application",
      "provider": ".NET Runtime",
      "channel": "Application",
      "level": "Error",
      "title": ".NET Runtime Unhandled Exception",
      "summary": "Unhandled exception in a .NET application.",
      "details": "Generated when a .NET application throws an unhandled exception and terminates. The event message contains the full exception type, message, and managed stack trace. Notable exception types include System.BadImageFormatException (malformed assembly load) and System.Security.SecurityException (permission block).",
      "category": "Application Crash",
      "tags": [
        "dotnet",
        "crash",
        "exception"
      ],
      "relatedEventIds": [
        {
          "id": 1000,
          "log": "Application"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1203",
          "techniqueName": "Exploitation for Client Execution",
          "tactics": [
            {
              "tacticId": "TA0002",
              "tacticName": "Execution"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Exception type is the primary pivot: System.Security.SecurityException may indicate AppLocker or WDAC blocking a .NET assembly",
          "System.BadImageFormatException on an unexpected assembly path may indicate a failed reflective load or in-memory execution attempt",
          "Stack trace namespaces that do not correspond to known installed software are a strong indicator of malicious .NET tooling",
          "Correlate the faulting assembly path with file creation events to determine how it arrived on the system"
        ],
        "commonFalsePositives": [
          "Legitimate .NET applications with unhandled exceptions due to bugs or misconfiguration",
          "Version mismatches between .NET runtime and application assemblies"
        ]
      },
      "keyFields": [
        {
          "name": "ExceptionType",
          "xpath": "EventData/Data[@Name='ExceptionType']",
          "description": "Full .NET exception type name"
        },
        {
          "name": "ExceptionMessage",
          "xpath": "EventData/Data[@Name='ExceptionMessage']",
          "description": "Exception message text with details about the failure"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/wer/windows-error-reporting"
      },
      "volumeIndicator": "medium",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-04-02"
    },
    {
      "id": 1033,
      "log": "Application",
      "provider": "MsiInstaller",
      "channel": "Application",
      "level": "Information",
      "title": "Windows Installer: Installation Operation",
      "summary": "MSI installation operation recorded.",
      "details": "Generated when a Windows Installer installation operation occurs. Records ProductName, ProductVersion, and result code. Provides early visibility into install activity before the final outcome (EID 11707/11708) is known.",
      "category": "Software Installation",
      "tags": [
        "msi",
        "install",
        "software"
      ],
      "relatedEventIds": [
        {
          "id": 11707,
          "log": "Application"
        },
        {
          "id": 11708,
          "log": "Application"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1072",
          "techniqueName": "Software Deployment Tools",
          "tactics": [
            {
              "tacticId": "TA0002",
              "tacticName": "Execution"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "ProductName against an approved software inventory — unexpected products warrant investigation",
          "Correlate timestamp with Security EID 4624 and 4688 to identify the account and process that initiated the install",
          "Installation outside approved change windows or on systems that should not receive new software is a priority alert"
        ],
        "commonFalsePositives": [
          "Legitimate software installations performed by IT or automated patch management",
          "Software self-update mechanisms triggering silent installs"
        ]
      },
      "keyFields": [
        {
          "name": "ProductName",
          "xpath": "EventData/Data[@Name='ProductName']",
          "description": "Name of the product being installed"
        },
        {
          "name": "ProductVersion",
          "xpath": "EventData/Data[@Name='ProductVersion']",
          "description": "Version of the product being installed"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/msi/event-logging"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-04-02"
    },
    {
      "id": 1034,
      "log": "Application",
      "provider": "MsiInstaller",
      "channel": "Application",
      "level": "Information",
      "title": "Windows Installer: Removal Operation",
      "summary": "MSI product removal operation recorded.",
      "details": "Generated when a Windows Installer removal operation occurs. Records the product being removed. Pairs with EID 11724 for confirmation of successful removal.",
      "category": "Software Installation",
      "tags": [
        "msi",
        "uninstall",
        "software",
        "defense-evasion"
      ],
      "relatedEventIds": [
        {
          "id": 11724,
          "log": "Application"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1070",
          "techniqueName": "Indicator Removal",
          "tactics": [
            {
              "tacticId": "TA0005",
              "tacticName": "Stealth"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "ProductName is the critical field — cross-reference against a list of installed security tools (AV, EDR, logging agents)",
          "Correlate with Security EID 4688 to identify the process that called msiexec.exe for the removal",
          "Removal of a security product immediately before or after other suspicious activity is a high-confidence defense evasion indicator"
        ],
        "commonFalsePositives": [
          "IT-initiated software removal during offboarding or refresh cycles",
          "Vendor-initiated silent updates that remove and reinstall components"
        ]
      },
      "keyFields": [
        {
          "name": "ProductName",
          "xpath": "EventData/Data[@Name='ProductName']",
          "description": "Name of the product being removed"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/msi/event-logging"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-05-10"
    },
    {
      "id": 8193,
      "log": "Application",
      "provider": "VSS",
      "channel": "Application",
      "level": "Error",
      "title": "Volume Shadow Copy Service error",
      "summary": "The Volume Shadow Copy Service encountered an error during an operation.",
      "details": "Generated by the Windows Volume Shadow Copy Service (VSS) when a snapshot operation fails, is aborted, or encounters an error. Records the specific VSS operation that failed, the error code, and context about which writer or provider encountered the issue. Most ransomware variants delete shadow copies as part of their pre-encryption routine, which triggers VSS errors as the service is disrupted.",
      "category": "Volume Shadow Copy",
      "tags": [
        "vss",
        "shadow-copy",
        "ransomware",
        "backup",
        "impact"
      ],
      "relatedEventIds": [
        {
          "id": 8194,
          "log": "Application"
        },
        {
          "id": 8196,
          "log": "Application"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1490",
          "techniqueName": "Inhibit System Recovery",
          "tactics": [
            {
              "tacticId": "TA0040",
              "tacticName": "Impact"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Multiple VSS errors in rapid succession are a strong ransomware pre-encryption indicator — correlate with process execution events immediately before",
          "Check for vssadmin.exe, wbadmin.exe, or wmic.exe in process creation logs (EID 4688 or Sysmon EID 1) around the same timestamp",
          "VSS errors during business hours on multiple endpoints simultaneously suggest coordinated ransomware execution"
        ],
        "commonFalsePositives": [
          "Backup software conflicts with VSS writers during scheduled backup operations",
          "Disk space exhaustion causing VSS snapshot operations to fail"
        ]
      },
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows-server/storage/file-server/volume-shadow-copy-service"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-04-04"
    },
    {
      "id": 8194,
      "log": "Application",
      "provider": "VSS",
      "channel": "Application",
      "level": "Error",
      "title": "Volume Shadow Copy Service backup failure",
      "summary": "The Volume Shadow Copy Service failed during a backup operation.",
      "details": "Generated when VSS fails during the backup phase of a snapshot operation, typically because a VSS writer reported an error or because the snapshot was aborted. Records the failing writer name, the error context, and the operation that was attempted. This event is valuable for both security monitoring and operational visibility into backup health.",
      "category": "Volume Shadow Copy",
      "tags": [
        "vss",
        "shadow-copy",
        "backup",
        "ransomware",
        "impact"
      ],
      "relatedEventIds": [
        {
          "id": 8193,
          "log": "Application"
        },
        {
          "id": 8196,
          "log": "Application"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1490",
          "techniqueName": "Inhibit System Recovery",
          "tactics": [
            {
              "tacticId": "TA0040",
              "tacticName": "Impact"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Correlate EID 8193/8194/8196 as a cluster — ransomware typically triggers all three in rapid succession",
          "Check the writer name — 'System Writer', 'ASR Writer', or 'Registry Writer' failures indicate system-level backup disruption",
          "Use process creation events around the VSS failure time to identify the process that initiated the deletion"
        ],
        "commonFalsePositives": [
          "Application-specific VSS writer failures during software updates or service restarts",
          "Backup window conflicts where multiple backup applications attempt concurrent snapshots"
        ]
      },
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows-server/storage/file-server/volume-shadow-copy-service"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-04-04"
    },
    {
      "id": 8196,
      "log": "Application",
      "provider": "VSS",
      "channel": "Application",
      "level": "Error",
      "title": "Volume Shadow Copy Service provider error",
      "summary": "A VSS hardware or software provider encountered an error.",
      "details": "Generated when a VSS provider (software or hardware) reports an error during snapshot creation or management. Records the provider name, the error code, and the operation context. Along with EIDs 8193 and 8194, this event is part of the VSS error cluster associated with shadow copy deletion. Provider-level errors can also indicate storage hardware issues.",
      "category": "Volume Shadow Copy",
      "tags": [
        "vss",
        "shadow-copy",
        "provider",
        "ransomware",
        "impact"
      ],
      "relatedEventIds": [
        {
          "id": 8193,
          "log": "Application"
        },
        {
          "id": 8194,
          "log": "Application"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1490",
          "techniqueName": "Inhibit System Recovery",
          "tactics": [
            {
              "tacticId": "TA0040",
              "tacticName": "Impact"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "The cluster of EID 8193 + 8194 + 8196 within seconds of each other is the canonical ransomware pre-encryption VSS signature",
          "Correlate with Sysmon EID 1 process creation for vssadmin.exe, wbadmin.exe, bcdedit.exe in the same timeframe",
          "Alert on this cluster appearing outside of scheduled backup windows"
        ],
        "commonFalsePositives": [
          "Hardware storage provider failures on SAN/NAS environments",
          "Third-party backup agent provider failures during normal backup operations"
        ]
      },
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows-server/storage/file-server/volume-shadow-copy-service"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-04-04"
    },
    {
      "id": 8224,
      "log": "Application",
      "provider": "VSS",
      "channel": "Application",
      "level": "Information",
      "title": "Volume Shadow Copy Service stopped",
      "summary": "The Volume Shadow Copy Service stopped.",
      "details": "Generated when the Volume Shadow Copy Service process exits. Under normal conditions VSS stops after completing a backup or snapshot operation and restarts on demand. This event is part of the VSS error cluster (EIDs 8193, 8194, 8196, 8224) that fires when shadow copy operations are disrupted.",
      "category": "Volume Shadow Copy",
      "tags": [
        "vss",
        "shadow-copy",
        "ransomware",
        "impact",
        "service-stop"
      ],
      "relatedEventIds": [
        {
          "id": 8193,
          "log": "Application"
        },
        {
          "id": 8194,
          "log": "Application"
        },
        {
          "id": 8196,
          "log": "Application"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1490",
          "techniqueName": "Inhibit System Recovery",
          "tactics": [
            {
              "tacticId": "TA0040",
              "tacticName": "Impact"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "The ransomware VSS signature is 8193 + 8194 + 8196 + 8224 within seconds — any subset of this cluster is sufficient to trigger investigation",
          "Check process creation logs for vssadmin.exe delete shadows, wbadmin delete catalog, wmic shadowcopy delete, or bcdedit /set recoveryenabled no in the same timeframe",
          "Correlate with Sysmon EID 11 file creation events for mass .encrypted/.locked extension renames immediately after VSS stop"
        ],
        "commonFalsePositives": [
          "Normal VSS service lifecycle — stops after completing legitimate backup or snapshot operations",
          "Backup software explicitly stopping VSS after its snapshot window completes"
        ]
      },
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows-server/storage/file-server/volume-shadow-copy-service"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-04-04"
    },
    {
      "id": 11707,
      "log": "Application",
      "provider": "MsiInstaller",
      "channel": "Application",
      "level": "Information",
      "title": "Windows Installer: Installation Completed Successfully",
      "summary": "MSI product installation succeeded.",
      "details": "Generated when a Windows Installer product installation completes successfully. Final confirmation of a successful install. The ProductName field identifies the installed product.",
      "category": "Software Installation",
      "tags": [
        "msi",
        "install",
        "software"
      ],
      "relatedEventIds": [
        {
          "id": 1033,
          "log": "Application"
        },
        {
          "id": 11708,
          "log": "Application"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1072",
          "techniqueName": "Software Deployment Tools",
          "tactics": [
            {
              "tacticId": "TA0002",
              "tacticName": "Execution"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Confirms installation success — pair with EID 1033 to establish the full install timeline",
          "Correlate ProductName with software inventory; presence of unknown or dual-use tools (e.g., remote access software) is a priority alert",
          "Check the installing account context via concurrent Security EID 4624/4688 events"
        ],
        "commonFalsePositives": [
          "Legitimate software installations by IT or automated deployment systems"
        ]
      },
      "keyFields": [
        {
          "name": "ProductName",
          "xpath": "EventData/Data[@Name='ProductName']",
          "description": "Name of the product that was successfully installed"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/msi/event-logging"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-04-02"
    },
    {
      "id": 11708,
      "log": "Application",
      "provider": "MsiInstaller",
      "channel": "Application",
      "level": "Error",
      "title": "Windows Installer: Installation Failed",
      "summary": "MSI product installation failed.",
      "details": "Generated when a Windows Installer product installation fails. Can indicate a tampered or unsigned package, insufficient privileges, AppLocker/WDAC blocking, or a corrupted installer.",
      "category": "Software Installation",
      "tags": [
        "msi",
        "install",
        "failure",
        "software"
      ],
      "relatedEventIds": [
        {
          "id": 1033,
          "log": "Application"
        },
        {
          "id": 11707,
          "log": "Application"
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Repeated failures for the same ProductName may indicate an attacker retrying a blocked payload installation",
          "Correlate with AppLocker or WDAC event logs to determine if a policy blocked the install",
          "Check the installing account — failure due to insufficient privileges from an unexpected account is suspicious"
        ],
        "commonFalsePositives": [
          "Failed installs due to missing dependencies, disk space, or user-cancelled prompts",
          "Installers failing due to version conflicts with existing software"
        ]
      },
      "keyFields": [
        {
          "name": "ProductName",
          "xpath": "EventData/Data[@Name='ProductName']",
          "description": "Name of the product whose installation failed"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/msi/event-logging"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-04-02"
    },
    {
      "id": 11724,
      "log": "Application",
      "provider": "MsiInstaller",
      "channel": "Application",
      "level": "Information",
      "title": "Windows Installer: Removal Completed Successfully",
      "summary": "MSI product removal succeeded.",
      "details": "Generated when a Windows Installer product removal completes successfully. The ProductName field identifies the removed product.",
      "category": "Software Installation",
      "tags": [
        "msi",
        "uninstall",
        "software",
        "defense-evasion"
      ],
      "relatedEventIds": [
        {
          "id": 1034,
          "log": "Application"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1070",
          "techniqueName": "Indicator Removal",
          "tactics": [
            {
              "tacticId": "TA0005",
              "tacticName": "Stealth"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Cross-reference ProductName against a list of security tools — confirmed removal of defensive software requires immediate escalation",
          "Correlate with EID 1034 to establish the full removal timeline",
          "Identify the account and process via concurrent Security EID 4624/4688 events"
        ],
        "commonFalsePositives": [
          "Routine software removal by IT during system refresh or decommission",
          "Vendor silent updates that remove old versions before installing new ones"
        ]
      },
      "keyFields": [
        {
          "name": "ProductName",
          "xpath": "EventData/Data[@Name='ProductName']",
          "description": "Name of the product that was successfully removed"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/msi/event-logging"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-05-10"
    }
  ]
}