DFIRHub

Windows event log ยท Microsoft-Windows-DeviceSetupManager/Admin112 USB Connection

  • Windows operational
  • 3 fields
  • Microsoft-Windows-DeviceSetupManager%4Admin.evtx
  • Microsoft-Windows-DeviceSetupManager

Fields EvtxECmd extracts

3 columns in the EvtxECmd CSV

  • PayloadData1Prop_DeviceName: %Prop_DeviceName%
    • %Prop_DeviceName% = /Event/EventData/Data[@Name="Prop_DeviceName"]
  • PayloadData2Prop_ContainerId: %Prop_ContainerId%
    • %Prop_ContainerId% = /Event/EventData/Data[@Name="Prop_ContainerId"]
  • PayloadData3Prop_WorkTime_MilliSeconds: %Prop_WorkTime_MilliSeconds%
    • %Prop_WorkTime_MilliSeconds% = /Event/EventData/Data[@Name="Prop_WorkTime_MilliSeconds"]

Sample event

Event XML from the map file

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DeviceSetupManager" Guid="{GUID}"/>
    <EventID>112</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2020-12-21T03:31:10.0547318Z"/>
    <EventRecordID>548</EventRecordID>
    <Correlation/>
    <Execution ProcessID="4804" ThreadID="14716"/>
    <Channel>Microsoft-Windows-DeviceSetupManager/Admin</Channel>
    <Computer>ComputerName</Computer>
    <Security UserID="{UserID}"/>
  </System>
  <EventData>
    <Data Name="Prop_DeviceName">Razer DeathAdder Elite</Data>
    <Data Name="Prop_ContainerId">{ContainerId}</Data>
    <Data Name="Prop_TaskCount">1</Data>
    <Data Name="Prop_PropertyCount">92</Data>
    <Data Name="Prop_WorkTime_MilliSeconds">578</Data>
  </EventData>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DeviceSetupManager" Guid="{GUID}"/>
    <EventID>112</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2020-12-21T03:31:10.0731149Z"/>
    <EventRecordID>549</EventRecordID>
    <Correlation/>
    <Execution ProcessID="4804" ThreadID="14716"/>
    <Channel>Microsoft-Windows-DeviceSetupManager/Admin</Channel>
    <Computer>ComputerName</Computer>
    <Security UserID="{UserID}"/>
  </System>
  <EventData>
    <Data Name="Prop_DeviceName">Portable SSD T5</Data>
    <Data Name="Prop_ContainerId">{ContainerId}</Data>
    <Data Name="Prop_TaskCount">1</Data>
    <Data Name="Prop_PropertyCount">34</Data>
    <Data Name="Prop_WorkTime_MilliSeconds">15</Data>
  </EventData>
</Event>

References

3 links

Source: evtx/Maps/Microsoft-Windows-DeviceSetupManager-Admin_Microsoft-Windows-DeviceSetupManager_112.map(opens in new tab) by Hyun Yi @hyuunnn and contributors(opens in new tab), MIT License(opens in new tab)