DFIRHub

Windows event log ยท Microsoft-Windows-DriverFrameworks-UserMode/Operational2100 USB Connection

Windows Vista, 7 : enable (default)

  • Windows operational
  • 2 fields
  • Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx
  • Microsoft-Windows-DriverFrameworks-UserMode

Notes

  • Windows Vista, 7 : enable (default)
  • Windows 8~ : disable (default)

Fields EvtxECmd extracts

2 columns in the EvtxECmd CSV

  • PayloadData1InstanceId: %InstanceId%
    • %InstanceId% = /Event/UserData/UMDFHostDeviceRequest/InstanceId
  • PayloadData2LifetimeId: %LifetimeId%
    • %LifetimeId% = /Event/UserData/UMDFHostDeviceRequest/LifetimeId

Sample event

Event XML from the map file

<System>
  <Provider Name="Microsoft-Windows-DriverFrameworks-UserMode" Guid="{GUID}"/>
  <EventID>2100</EventID>
  <Version>1</Version>
  <Level>4</Level>
  <Task>37</Task>
  <Opcode>1</Opcode>
  <Keywords>0x8000000000000000</Keywords>
  <TimeCreated SystemTime="2020-12-06T08:47:21.6579567Z"/>
  <EventRecordID>27</EventRecordID>
  <Correlation/>
  <Execution ProcessID="2184" ThreadID="8936"/>
  <Channel>Microsoft-Windows-DriverFrameworks-UserMode/Operational</Channel>
  <Computer>ComputerName</Computer>
  <Security UserID="S-1-5-19"/>
</System>
<UserData>
  <UMDFHostDeviceRequest xmlns="http://www.microsoft.com/DriverFrameworks/UserMode/Event">
    <LifetimeId>{Value}</LifetimeId>
    <InstanceId>SWD\WPDBUSENUM\_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER_BLADE&REV_1.27#{Value}&0#{Value}</InstanceId>
    <RequestMajorCode>27</RequestMajorCode>
    <RequestMinorCode>0</RequestMinorCode>
    <Argument1>0x0</Argument1>
    <Argument2>0x0</Argument2>
    <Argument3>0x0</Argument3>
    <Argument4>0x0</Argument4>
    <Status>3221225659</Status>
  </UMDFHostDeviceRequest>
</UserData>
</Event>

References

4 links

Source: evtx/Maps/Microsoft-Windows-DriverFrameworks-UserMode-Operational_Microsoft-Windows-DriverFrameworks-UserMode_2100.map(opens in new tab) by Hyun Yi @hyuunnn and contributors(opens in new tab), MIT License(opens in new tab)