detection.wiki

Microsoft-Windows-Storsvc › Event 1001

Event ID 1001 — For internal use only.

Provider
Microsoft-Windows-Storsvc
Channel
Diagnostic
Level
Informational

Description

For internal use only.

Message #

For internal use only.

Fields #

NameDescription
Version UInt32—
DiskNumber UInt32—
VendorId AnsiString—
ProductId AnsiString—
ProductRevision AnsiString—
SerialNumber AnsiString—
ParentId UnicodeString—
FileSystem UnicodeString—
BusType UInt32—
PartitionStyle UInt32—
VolumeCount UInt32—
ContainsRawVolumes Boolean—
Size UInt64—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Storsvc",
    "guid": "A963A23C-0058-521D-71EC-A1CCE6173F21",
    "event_source_name": "",
    "event_id": 1001,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-07T17:41:20.034286+00:00",
    "event_record_id": 4,
    "correlation": {
      "ActivityID": "E0AAB88C-4A9F-0000-7BBB-AAE09F4AD801"
    },
    "execution": {
      "process_id": 1332,
      "thread_id": 4112
    },
    "channel": "Microsoft-Windows-Storsvc/Diagnostic",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Version": 2,
    "DiskNumber": 1,
    "VendorId": "VendorCo",
    "ProductId": "ProductCode",
    "ProductRevision": "2.00",
    "SerialNumber": "9207032533193411390",
    "ParentId": "USB\\VID_FFFF&PID_5678\\9207032533193411390",
    "FileSystem": "FAT32",
    "BusType": 7,
    "PartitionStyle": 0,
    "VolumeCount": 1,
    "ContainsRawVolumes": false,
    "Size": 16672358400
  },
  "message": ""
}

References #