detection.wiki

Microsoft-Windows-CDROM

EventTitleChannelSampleRule
100CDROM_DRIVEROperationalNN
103Zero Power ODD power on start.OperationalNN
104Zero Power ODD power on stop.OperationalNN

Event ID 100: CDROM_DRIVER

#
Channel
Operational
Task
CDROM_DRIVER

Fields #

NameDescription
DeviceName UnicodeString

Event ID 103: Zero Power ODD power on start.

#
Channel
Operational
Task
SettingdevicepowerforZeroPowerODD.
Opcode
Start

Event ID 104: Zero Power ODD power on stop.

#
Channel
Operational
Task
SettingdevicepowerforZeroPowerODD.
Opcode
Stop

Provenance

ETW provider GUID 9b6123dc-9af6-4430-80d7-7d36f054fb9f

Defined in cdrom.sys, the binary that emits these events.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB