detection.wiki

Microsoft-Windows-Kernel-PnP › Event 400

Event ID 400 — Device DeviceInstanceId was configured.

Provider
Microsoft-Windows-Kernel-PnP
Channel
Configuration
Level
Informational
Collection Priority
Recommended (NSA)
Opcode
Info

Description

Device DeviceInstanceId was configured.

Message #

Device %1 was configured.

Driver Name: %2
Class GUID: %3
Driver Date: %4
Driver Version: %5
Driver Provider: %6
Driver Section: %8
Driver Rank: %9
Matching Device ID: %10
Outranked Drivers: %11
Device Updated: %12
Parent Device: %14

Fields #

NameDescription
DeviceInstanceId UnicodeString—
DriverName UnicodeString—
ClassGuid GUID—
DriverDate UnicodeString—
DriverVersion UnicodeString—
DriverProvider UnicodeString—
DriverInbox Boolean—
DriverSection UnicodeString—
DriverRank HexInt32—
MatchingDeviceId UnicodeString—
OutrankedDrivers UnicodeString—
DeviceUpdated Boolean—
Status HexInt32— NTSTATUS reference
ParentDeviceInstanceId UnicodeStringParent Device.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "9C205A39-1250-487D-ABD7-E831C6290539",
    "event_source_name": "",
    "event_id": 400,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-11-06T06:20:50.122130+00:00",
    "event_record_id": 211,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "Microsoft-Windows-Kernel-PnP/Configuration",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceInstanceId": "ACPI\\GenuineIntel_-_Intel64_Family_6_Model_183_-_13th_Gen_Intel(R)_Core(TM)_i9-13980HX\\_3",
    "DriverName": "cpu.inf",
    "ClassGuid": "50127DC3-0F36-415E-A6CC-4CB3BE910B65",
    "DriverDate": "04/21/2009",
    "DriverVersion": "10.0.22621.2215",
    "DriverProvider": "Microsoft",
    "DriverInbox": true,
    "DriverSection": "IntelPPM_Inst.NT",
    "DriverRank": "0xff0004",
    "MatchingDeviceId": "ACPI\\GenuineIntel_-_Intel64",
    "OutrankedDrivers": "cpu.inf:ACPI\\Processor:00FF2000",
    "DeviceUpdated": false,
    "Status": "0x0",
    "ParentDeviceInstanceId": "ACPI_HAL\\PNP0C08\\0"
  },
  "message": ""
}

References #