detection.wiki

Microsoft-Windows-DriverFrameworks-UserMode › Event 10000

Event ID 10000 — A driver package which uses user-mode driver framework version UMDFDeviceInstallBegin.FrameworkVersion is being installed on device UMDFDeviceInstallBegin.DeviceId.

Provider
Microsoft-Windows-DriverFrameworks-UserMode
Channel
System
Level
Informational
Task
Installationorupdateofdevicedrivers.
Opcode
Start

Description

A driver package which uses user-mode driver framework version UMDFDeviceInstallBegin.FrameworkVersion is being installed on device UMDFDeviceInstallBegin.DeviceId.

Message #

A driver package which uses user-mode driver framework version %2 is being installed on device %1.

Fields #

NameDescription
UMDFDeviceInstallBegin.DeviceId—
UMDFDeviceInstallBegin.FrameworkVersion—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 10000,
    "version": 1,
    "level": 4,
    "task": 48,
    "opcode": 1,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T16:53:01.068372+00:00",
    "event_record_id": 375,
    "correlation": {},
    "execution": {
      "process_id": 2204,
      "thread_id": 4904
    },
    "channel": "System",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "UMDFDeviceInstallBegin": {
      "DeviceId": "SWD\\WPDBUSENUM\\_??_USBSTOR#DISK&VEN_VENDORCO&PROD_PRODUCTCODE&REV_2.00#9207032533193411390&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}",
      "FrameworkVersion": "2.33.0"
    }
  },
  "message": ""
}

References #