detection.wiki

Microsoft-Windows-SMBClient › Event 30812

Event ID 30812 — Added a TDI transport interface.

Provider
Microsoft-Windows-SMBClient
Channel
Connectivity
Level
Informational
Opcode
Info

Description

Added a TDI transport interface.

Message #

Added a TDI transport interface.

Name: %2

Guidance:
A TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.

Fields #

NameDescription
ServerNameLength UInt16—
ServerName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "988C59C5-0A1C-45B6-A555-0C62276E327D",
    "event_source_name": "",
    "event_id": 30812,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 288230376151711808,
    "time_created": "2023-11-06T06:25:42.665527+00:00",
    "event_record_id": 88,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 224
    },
    "channel": "Microsoft-Windows-SmbClient/Connectivity",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ServerNameLength": 58,
    "ServerName": "\\Device\\NetBT_Tcpip_{3D03B11E-98A0-4304-84E2-CD3AAE8EFE1D}"
  },
  "message": ""
}

References #