DFIRHub

Windows event log ยท Microsoft-Windows-PrintService/Operational307 Printing a document

The document name is not recorded in the event record until enabled via Group Policy

  • Windows operational
  • 6 fields
  • Microsoft-Windows-PrintService%4Operational.evtx
  • Microsoft-Windows-PrintService

Notes

  • The document name is not recorded in the event record until enabled via Group Policy
  • Param1 --> Document Number
  • Param2 --> Document Name
  • Param3 --> PrintUser
  • Param4 --> PrintHost
  • Param5 --> Printer Name
  • Param6 --> Printer Port
  • Param7 --> Document size in Bytes
  • Param8 --> Number of Pages

Fields EvtxECmd extracts

6 columns in the EvtxECmd CSV

  • PayloadData1Print User: %PrintUser%
    • %PrintUser% = /Event/UserData/DocumentPrinted/Param3
  • PayloadData2Printer Name: %PrinterName%
    • %PrinterName% = /Event/UserData/DocumentPrinted/Param5
  • PayloadData3Document Name: %DocumentName%
    • %DocumentName% = /Event/UserData/DocumentPrinted/Param2
  • PayloadData4Printer Port: %PrinterPort%
    • %PrinterPort% = /Event/UserData/DocumentPrinted/Param4
  • PayloadData5Size in Bytes: %Bytes%
    • %Bytes% = /Event/UserData/DocumentPrinted/Param7
  • PayloadData6Pages: %Pages%
    • %Pages% = /Event/UserData/DocumentPrinted/Param8

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-PrintService" Guid="{747ef6fd-e535-4d16-b510-42c90f6873a1}"/>
    <EventID>307</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>26</Task>
    <Opcode>11</Opcode>
    <Keywords>0x4000000000000840</Keywords>
    <TimeCreated SystemTime="2019-03-03T09:11:15.100788800Z"/>
    <EventRecordID>29</EventRecordID>
    <Correlation/>
    <Execution ProcessID="3944" ThreadID="11336"/>
    <Channel>Microsoft-Windows-PrintService/Operational</Channel>
    <Computer>pooh</Computer>
    <Security UserID="S-1-5-21-1987904521-730768085-2188298509-1001"/>
  </System>
  <UserData>
    <DocumentPrinted xmlns="http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events">
      <Param1>3</Param1>
      <Param2>Print Document</Param2>
      <Param3>baz</Param3>
      <Param4>\\POOH</Param4>
      <Param5>Microsoft Print to PDF</Param5>
      <Param6>D:\ownCloud\SANS\Investigating WMI Attacks\Investigating WMI Attacks Confirmation1.pdf</Param6>
      <Param7>772216</Param7>
      <Param8>2</Param8>
    </DocumentPrinted>
  </UserData>
</Event>

References

3 links

Source: evtx/Maps/Microsoft-Windows-PrintService-Operational_Microsoft-Windows-PrintService_307.map(opens in new tab) by Barrie Hill and contributors(opens in new tab), MIT License(opens in new tab)