detection.wiki

Microsoft-Windows-OverlayFilter

19 events across 1 channel

Event IDTitleChannel
24832The filter failed to open the integrity file for FileNameBuffer (data source …System
24833The filter failed to validate block BlockNumber of length BlockLength from …System
24834The filter failed to validate a read from FileNameBuffer at file offset …System
24835The task is enumerating Volume volume.System
24836The task has failed to report integrity file generation completion to BitLocker.System
24837The task has created integrity file wimHashFile for file wimFile.System
24838The task has completed generation of integrity file wimHashFile for file …System
24839The task has deleted integrity file wimHashFile for file wimFile.System
24840The task is resuming generation of integrity file filename at file offset …System
24841The task has paused generation of integrity file filename at file offset offset.System
24842The task has failed to identify encryption/decryption state.System
24843The task has failed to generate integrity file wimHashFile for file wimFile.System
24844The task has failed to delete integrity file wimHashFile for file wimFile.System
24845The task has failed to read file at wimHashFile.System
24846The task has failed to write file at wimHashFile.System
24847The filter opened the integrity file for FileNameBuffer (data source …System
24848The filter did not open the integrity file for FileNameBuffer (data source …System
24849The task is generating integrity filesSystem
24850The task is deleting integrity filesSystem

Event ID 24832 — The filter failed to open the integrity file for FileNameBuffer (data source DataSourceId) with status Status.

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
WIMintegrityverification
Opcode
IntegrityFileOpen

Description

The filter failed to open the integrity file for FileNameBuffer (data source DataSourceId) with status Status.

Message #

The filter failed to open the integrity file for %2 (data source %3) with status %4.

Fields #

NameDescription
FileNameLength UInt16—
FileNameBuffer UnicodeString—
DataSourceId Int64—
Status HexInt32— NTSTATUS reference

Event ID 24833 — The filter failed to validate block BlockNumber of length BlockLength from FileNameBuffer.

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
WIMintegrityverification
Opcode
IntegrityBlockVerificationFailure

Description

The filter failed to validate block BlockNumber of length BlockLength from FileNameBuffer.

Message #

The filter failed to validate block %3 of length %4 from %2.

Fields #

NameDescription
FileNameLength UInt16—
FileNameBuffer UnicodeString—
BlockNumber UInt32—
BlockLength UInt32—

Event ID 24834 — The filter failed to validate a read from FileNameBuffer at file offset FileOffset of length ReadSize.

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
WIMintegrityverification
Opcode
IntegrityInvalidBlock

Description

The filter failed to validate a read from FileNameBuffer at file offset FileOffset of length ReadSize.

Message #

The filter failed to validate a read from %2 at file offset %3 of length %4.

Fields #

NameDescription
FileNameLength UInt16—
FileNameBuffer UnicodeString—
FileOffset Int64—
ReadSize UInt32—

Event ID 24835 — The task is enumerating Volume volume.

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
TheWindowsOverlayTask
Opcode
EnumVolume

Description

The task is enumerating Volume volume.

Message #

The task is enumerating Volume %1

Fields #

NameDescription
volume UnicodeString—

Event ID 24836 — The task has failed to report integrity file generation completion to BitLocker.

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
TheWindowsOverlayTask
Opcode
ReportHashGenerationToBitlockerError

Description

The task has failed to report integrity file generation completion to BitLocker. HRESULT = hr.

Message #

The task has failed to report integrity file generation completion to BitLocker. HRESULT = %1

Fields #

NameDescription
hr UInt32—

Event ID 24837 — The task has created integrity file wimHashFile for file wimFile.

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
TheWindowsOverlayTask
Opcode
CreateHashFile

Description

The task has created integrity file wimHashFile for file wimFile.

Message #

The task has created integrity file %1 for file %2

Fields #

NameDescription
wimHashFile UnicodeString—
wimFile UnicodeString—

Event ID 24838 — The task has completed generation of integrity file wimHashFile for file wimFile.

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
TheWindowsOverlayTask
Opcode
CompleteHashFile

Description

The task has completed generation of integrity file wimHashFile for file wimFile.

Message #

The task has completed generation of integrity file %1 for file %2

Fields #

NameDescription
wimHashFile UnicodeString—
wimFile UnicodeString—

Event ID 24839 — The task has deleted integrity file wimHashFile for file wimFile.

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
TheWindowsOverlayTask
Opcode
DeleteHashFile

Description

The task has deleted integrity file wimHashFile for file wimFile.

Message #

The task has deleted integrity file %1 for file %2

Fields #

NameDescription
wimHashFile UnicodeString—
wimFile UnicodeString—

Event ID 24840 — The task is resuming generation of integrity file filename at file offset offset.

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
TheWindowsOverlayTask
Opcode
ResumeHashFile

Description

The task is resuming generation of integrity file filename at file offset offset.

Message #

The task is resuming generation of integrity file %1 at file offset %2

Fields #

NameDescription
filename UnicodeString—
offset UInt64—

Event ID 24841 — The task has paused generation of integrity file filename at file offset offset.

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
TheWindowsOverlayTask
Opcode
PauseHashFile

Description

The task has paused generation of integrity file filename at file offset offset.

Message #

The task has paused generation of integrity file %1 at file offset %2

Fields #

NameDescription
filename UnicodeString—
offset UInt64—

Event ID 24842 — The task has failed to identify encryption/decryption state.

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
TheWindowsOverlayTask
Opcode
ActionError

Description

The task has failed to identify encryption/decryption state. HRESULT = hr.

Message #

The task has failed to identify encryption/decryption state. HRESULT = %1

Fields #

NameDescription
hr UInt32—

Event ID 24843 — The task has failed to generate integrity file wimHashFile for file wimFile.

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
TheWindowsOverlayTask
Opcode
GenerateHashFileError

Description

The task has failed to generate integrity file wimHashFile for file wimFile. HRESULT = hr.

Message #

The task has failed to generate integrity file %1 for file %2. HRESULT = %3

Fields #

NameDescription
wimHashFile UnicodeString—
wimFile UnicodeString—
hr Int32—

Event ID 24844 — The task has failed to delete integrity file wimHashFile for file wimFile.

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
TheWindowsOverlayTask
Opcode
DeleteHashFileError

Description

The task has failed to delete integrity file wimHashFile for file wimFile. HRESULT = hr.

Message #

The task has failed to delete integrity file %1 for file %2. HRESULT = %3

Fields #

NameDescription
wimHashFile UnicodeString—
wimFile UnicodeString—
hr Int32—

Event ID 24845 — The task has failed to read file at wimHashFile.

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
TheWindowsOverlayTask
Opcode
FileReadError

Description

The task has failed to read file at wimHashFile. HRESULT = hr.

Message #

The task has failed to read file at %1. HRESULT = %3

Fields #

NameDescription
wimHashFile UnicodeString—
wimFile UnicodeString—
hr Int32—

Event ID 24846 — The task has failed to write file at wimHashFile.

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
TheWindowsOverlayTask
Opcode
FileWriteError

Description

The task has failed to write file at wimHashFile. HRESULT = hr.

Message #

The task has failed to write file at %1. HRESULT = %3

Fields #

NameDescription
wimHashFile UnicodeString—
wimFile UnicodeString—
hr Int32—

Event ID 24847 — The filter opened the integrity file for FileNameBuffer (data source DataSourceId).

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
WIMintegrityverification
Opcode
IntegrityFileOpen

Description

The filter opened the integrity file for FileNameBuffer (data source DataSourceId).

Message #

The filter opened the integrity file for %2 (data source %3).

Fields #

NameDescription
FileNameLength UInt16—
FileNameBuffer UnicodeString—
DataSourceId Int64—

Event ID 24848 — The filter did not open the integrity file for FileNameBuffer (data source DataSourceId) because it is not ready.

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
WIMintegrityverification
Opcode
IntegrityFileOpen

Description

The filter did not open the integrity file for FileNameBuffer (data source DataSourceId) because it is not ready.

Message #

The filter did not open the integrity file for %2 (data source %3) because it is not ready.

Fields #

NameDescription
FileNameLength UInt16—
FileNameBuffer UnicodeString—
DataSourceId Int64—

Event ID 24849 — The task is generating integrity files

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
TheWindowsOverlayTask
Opcode
ActionGenerateHashes

Description

The task is generating integrity files.

Message #

The task is generating integrity files

Event ID 24850 — The task is deleting integrity files

Provider
Microsoft-Windows-OverlayFilter
Channel
System
Task
TheWindowsOverlayTask
Opcode
ActionDeleteHashes

Description

The task is deleting integrity files.

Message #

The task is deleting integrity files