detection.wiki

Microsoft-Windows-DriverFrameworks-UserMode › Event 10001

Event ID 10001 — The UMDF service UMDFServiceInstall.ServiceName (CLSID UMDFServiceInstall.CLSID) was installed.

Provider
Microsoft-Windows-DriverFrameworks-UserMode
Channel
System
Level
Informational
Task
Installationorupdateofdevicedrivers.

Description

The UMDF service UMDFServiceInstall.ServiceName (CLSID UMDFServiceInstall.CLSID) was installed. It requires framework version UMDFServiceInstall.MinimumFxVersion or higher.

Message #

The UMDF service %1 (CLSID %2) was installed.  It requires framework version %3 or higher.

Fields #

NameDescription
UMDFServiceInstall.ServiceName—
UMDFServiceInstall.CLSID—
UMDFServiceInstall.MinimumFxVersion—
UMDFServiceInstall.Upgrade—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 10001,
    "version": 1,
    "level": 4,
    "task": 48,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T16:53:01.087249+00:00",
    "event_record_id": 376,
    "correlation": {},
    "execution": {
      "process_id": 2204,
      "thread_id": 4904
    },
    "channel": "System",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "UMDFServiceInstall": {
      "ServiceName": "WpdFs",
      "CLSID": "112DE495-AC4C-46F8-B663-6A4266C53313",
      "MinimumFxVersion": "2.33.0",
      "Upgrade": false
    }
  },
  "message": ""
}

References #