detection.wiki

Microsoft-Windows-StorPort › Event 524

Event ID 524 — The miniport logged an event.

Provider
Microsoft-Windows-StorPort
Channel
Operational
Level
Error
Task
Port

Description

The miniport logged an event.

Message #

The miniport logged an event.

Fields #

NameDescription
MiniportName UnicodeString—
MiniportEventId UInt32—
MiniportEventDescription UnicodeString—
PortNumber UInt32—
AdapterGuid GUID—
PathID UInt8—
TargetID UInt8—
LUN UInt8—
ClassDeviceGuid GUID—
VendorId AnsiString—
ProductId AnsiString—
SerialNumber AnsiString—
BootDevice Boolean—
Irp Pointer—
Srb Pointer—
Parameter1Name UnicodeString—
Parameter1Value UInt64—
Parameter2Name UnicodeString—
Parameter2Value UInt64—
Parameter3Name UnicodeString—
Parameter3Value UInt64—
Parameter4Name UnicodeString—
Parameter4Value UInt64—
Parameter5Name UnicodeString—
Parameter5Value UInt64—
Parameter6Name UnicodeString—
Parameter6Value UInt64—
Parameter7Name UnicodeString—
Parameter7Value UInt64—
Parameter8Name UnicodeString—
Parameter8Value UInt64—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorPort",
    "guid": "C4636A1E-7986-4646-BF10-7BC3B4A76E8E",
    "event_source_name": "",
    "event_id": 524,
    "version": 3,
    "level": 2,
    "task": 201,
    "opcode": 0,
    "keywords": 576495936809730048,
    "time_created": "2022-04-07T16:52:37.713027+00:00",
    "event_record_id": 68,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 76
    },
    "channel": "Microsoft-Windows-Storage-Storport/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "MiniportName": "stornvme",
    "MiniportEventId": 12,
    "MiniportEventDescription": "Admin Command Error",
    "PortNumber": 3,
    "AdapterGuid": "61E10B57-B69A-11EC-9774-806E6F6E6963",
    "PathID": 0,
    "TargetID": 0,
    "LUN": 0,
    "ClassDeviceGuid": "00000000-0000-0000-0000-000000000000",
    "VendorId": "",
    "ProductId": "",
    "SerialNumber": "",
    "BootDevice": false,
    "Irp": "0x0",
    "Srb": "0xffff860f0c948368",
    "Parameter1Name": "OPC",
    "Parameter1Value": 10,
    "Parameter2Name": "SCT",
    "Parameter2Value": 0,
    "Parameter3Name": "SC",
    "Parameter3Value": 2,
    "Parameter4Name": "CmdInfo",
    "Parameter4Value": 127,
    "Parameter5Name": "ControllerStatus",
    "Parameter5Value": 1,
    "Parameter6Name": "NULL",
    "Parameter6Value": 0,
    "Parameter7Name": "NULL",
    "Parameter7Value": 0,
    "Parameter8Name": "NULL",
    "Parameter8Value": 0
  },
  "message": ""
}

References #