Description

File System Filter 'DeviceName' (Version DeviceVersionMajor.DeviceVersionMinor, DeviceTime) unloaded successfully.

Message #

File System Filter '%5' (Version %2.%3, %6) unloaded successfully.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FilterManager",
    "guid": "F3C5E28E-63F6-49C7-A204-E48A1BC4B09D",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T06:25:40.330241+00:00",
    "event_record_id": 1681,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 52
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FinalStatus": "0x0",
    "DeviceVersionMajor": 10,
    "DeviceVersionMinor": 0,
    "DeviceNameLength": 6,
    "DeviceName": "CldFlt",
    "DeviceTime": "2074-05-01T16:21:15.000000Z"
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

Name caching for File System Filters has been disabled on volume 'ExtraString'.

Message #

Name caching for File System Filters has been disabled on volume '%3'.

Fields #

Description

Filter Manager failed to attach to volume 'ExtraString'. This volume will be unavailable for filtering until a reboot. The final status was FinalStatus.

Message #

Filter Manager failed to attach to volume '%3'.  This volume will be unavailable for filtering until a reboot.  The final status was %1.

Fields #

Message #

File System Filter '%5' (Version %2.%3, %6) failed to attach to volume '%8'.  The filter returned a non-standard final status of %1.  This filter and/or its supporting applications should handle this condition.  If this condition persists, contact the vendor.

Fields #

Description

File System Filter 'DeviceName' (Version DeviceVersionMajor.DeviceVersionMinor, DeviceTime) failed to register with Filter Manager. The final status for this operation was FinalStatus.

Message #

File System Filter '%5' (Version %2.%3, %6) failed to register with Filter Manager.  The final status for this operation was %1.

Fields #

Description

File System Filter 'DeviceName' (DeviceVersionMajor.DeviceVersionMinor, DeviceTime) has successfully loaded and registered with Filter Manager.

Message #

File System Filter '%5' (%2.%3, %6) has successfully loaded and registered with Filter Manager.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FilterManager",
    "guid": "F3C5E28E-63F6-49C7-A204-E48A1BC4B09D",
    "event_source_name": "",
    "event_id": 6,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T06:25:40.431588+00:00",
    "event_record_id": 1684,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 52
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FinalStatus": "0x0",
    "DeviceVersionMajor": 10,
    "DeviceVersionMinor": 0,
    "DeviceNameLength": 7,
    "DeviceName": "bindflt",
    "DeviceTime": "2010-05-16T11:24:57.000000Z"
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Description

File System Filter 'DeviceName' (Version DeviceVersionMajor.DeviceVersionMinor, DeviceTime) failed to start filtering. The final status for this operation was FinalStatus.

Message #

File System Filter '%5' (Version %2.%3, %6) failed to start filtering.  The final status for this operation was %1.

Fields #

Description

Filter Manager successfully attached to volume 'ExtraString'.

Message #

Filter Manager successfully attached to volume '%3'.

Fields #

Description

Filter Manager failed to attach to file system control device object (CDO) 'ExtraString'. All volumes associated with this file system will be unavailable for filtering until a reboot. The final status was FinalStatus.

Message #

Filter Manager failed to attach to file system control device object (CDO) '%3'.  All volumes associated with this file system will be unavailable for filtering until a reboot. The final status was %1.

Fields #

Description

Filter Manager successfully attached to file system 'ExtraString'.

Message #

Filter Manager successfully attached to file system '%3'.

Fields #

Description

File System Filter 'DeviceName' (Version DeviceVersionMajor.DeviceVersionMinor, DeviceTime) does not support bypass IO.

Message #

File System Filter '%1' (Version %2.%3, %4) does not support bypass IO.
Supported features: %5.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FilterManager",
    "guid": "F3C5E28E-63F6-49C7-A204-E48A1BC4B09D",
    "event_source_name": "",
    "event_id": 11,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T00:12:50.565375+00:00",
    "event_record_id": 2060,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 10280
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceName": "avgntflt",
    "DeviceVersionMajor": 10,
    "DeviceVersionMinor": 0,
    "DeviceTime": "2021-10-12T03:32:13.000000Z",
    "SupportedFeatures": "0x7"
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

File System Filter 'Process' (Version File.Bypass_IO_Operation, Vetoing_Reason) vetoed bypass IO.

Message #

File System Filter '%1' (Version %2.%3, %4) vetoed bypass IO.

     Process: %5
     File: %6
     Bypass IO Operation: %7
     Vetoing Reason: %8
     Operation Status: %9

Fields #

Description

Filter Manager failed to load filter attach policy for this volume.

Message #

Filter Manager failed to load filter attach policy for this volume.

     Volume name: %2
     Volume GUID: %3
     File system GUID: %4
     File system driver: %6
     Status: %7

Fields #

Description

Filter Manager successfully loaded filter attach policy for this volume.

Message #

Filter Manager successfully loaded filter attach policy for this volume.

     Volume name: %2
     Volume GUID: %3
     File system GUID: %4
     File system driver: %6

     GpAllowStatus: %7
     SystemAllowStatus: %10
     VolumeAllowStatus: %13
     Allow antivirus filter: %16
     Antivirus policy is from group policy: %17

Fields #