DFIRHub

Windows event log ยท Microsoft-Windows-PrintService/Operational316 Adding a printer driver

Example message from Windows Event Viewer: Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, DLL-U-C-Me-Now.dll, DLL-U-C-Me-Now.dll. No user action is required.

  • Windows operational
  • 3 fields
  • Microsoft-Windows-PrintService%4Operational.evtx
  • Microsoft-Windows-PrintService

Notes

  • Example message from Windows Event Viewer: Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, DLL-U-C-Me-Now.dll, DLL-U-C-Me-Now.dll. No user action is required.
  • Param1 --> Printer Driver
  • Param2 --> Operating System
  • Param3 --> Operating System Version
  • Param4 --> Files Added or Updated

Fields EvtxECmd extracts

3 columns in the EvtxECmd CSV

  • ExecutableInfo%Param4%
    • %Param4% = /Event/UserData/DriverAdded/Param4
  • PayloadData1PrinterDriver: %Param1%
    • %Param1% = /Event/UserData/DriverAdded/Param1
  • PayloadData2OperatingSystem: %Param2% %Param3%
    • %Param2% = /Event/UserData/DriverAdded/Param2
    • %Param3% = /Event/UserData/DriverAdded/Param3

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-PrintService" Guid="747ef6fd-e535-4d16-b510-42c90f6873a1"/>
    <EventID>316</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>8</Task>
    <Opcode>11</Opcode>
    <Keywords>0x4000000000000679</Keywords>
    <TimeCreated SystemTime="2021-05-30 15:22:15.9708006"/>
    <EventRecordID>2</EventRecordID>
    <Correlation/>
    <Execution ProcessID="2980" ThreadID="6728"/>
    <Channel>Microsoft-Windows-PrintService/Operational</Channel>
    <Computer>HOSTNAME</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <UserData>
    <DriverAdded>
      <Param1>1234</Param1>
      <Param2>Windows x64</Param2>
      <Param3>Version-3</Param3>
      <Param4>UNIDRV.DLL, kernelbase.dll, not-a-real-payload.dll</Param4>
    </DriverAdded>
  </UserData>
</Event>
<Event>

References

2 links

Source: evtx/Maps/Microsoft-Windows-PrintService-Operational_Microsoft-Windows-PrintService_316.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)