detection.wiki

Microsoft-Windows-DAL-Provider

EventTitleChannelSampleRule
1The Unencrypted request data for IPMI request NetFn.AnalyticNN
2The Decrypted response data for IPMI request NetFn.AnalyticNN
3Starts enumeration of PCSVDeviceAnalyticNN
4Stops enumeration of PCSVDeviceAnalyticNN
5Starts getting instance of PCSVDeviceAnalyticNN
6Stops getting instance of PCSVDeviceAnalyticNN
7Start RequestStateChangeAnalyticNN
8Stops RequestStateChangeAnalyticNN
9Starts SetOneTimeBootSourceAnalyticNN
10Stops SetOneTimeBootSourceAnalyticNN
11Result of PCSVDevice operationOperationalNN
15Information on IPMI Sent DataAnalyticNN
16Information on IPMI Received DataAnalyticNN
17Get operations optionsOperationalNN
18Starts ModifyPersistentBootConfigOrderAnalyticNN
19Stops ModifyPersistentBootConfigOrderAnalyticNN
20Starts ChangeBootConfigurationAnalyticNN
21Stops ChangeBootConfigurationAnalyticNN
22Starts ChangeNetworkConfigurationAnalyticNN
23Stops ChangeNetworkConfigurationAnalyticNN
24Starts ChangeUserPasswordAnalyticNN
25Stops ChangeUserPasswordAnalyticNN
26Starts getting PCSV device logAnalyticNN
27Stops getting PCSV device logAnalyticNN
28Starts clearing PCSV device logAnalyticNN
29Stops clearing PCSV device logAnalyticNN
30The request data for in-band IPMI request NetFn.AnalyticNN
31The response data for in-band IPMI request NetFn.AnalyticNN

Event ID 1: The Unencrypted request data for IPMI request NetFn.

#
Channel
Analytic

Message #

The Unencrypted request data for IPMI request %1

Fields #

NameDescription
NetFn UInt8
CommandID UInt8
PacketSize UInt32
PacketData Binary
SessionId UInt32
SequenceNumber UInt32

Event ID 2: The Decrypted response data for IPMI request NetFn.

#
Channel
Analytic

Message #

The Decrypted response data for IPMI request %1

Fields #

NameDescription
NetFn UInt8
CommandID UInt8
PacketSize UInt32
PacketData Binary
SessionId UInt32
SequenceNumber UInt32

Event ID 3: Starts enumeration of PCSVDevice

#
Channel
Analytic

Event ID 4: Stops enumeration of PCSVDevice

#
Channel
Analytic

Event ID 5: Starts getting instance of PCSVDevice

#
Channel
Analytic

Event ID 6: Stops getting instance of PCSVDevice

#
Channel
Analytic

Event ID 7: Start RequestStateChange

#
Channel
Analytic

Event ID 8: Stops RequestStateChange

#
Channel
Analytic

Event ID 9: Starts SetOneTimeBootSource

#
Channel
Analytic

Event ID 10: Stops SetOneTimeBootSource

#
Channel
Analytic

Event ID 11: Result of PCSVDevice operation

#
Channel
Operational

Fields #

NameDescription
MI_Result Int32
Operation UnicodeString
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 15: Information on IPMI Sent Data

#
Channel
Analytic

Fields #

NameDescription
id UInt8

Event ID 16: Information on IPMI Received Data

#
Channel
Analytic

Fields #

NameDescription
id UInt8

Event ID 17: Get operations options

#
Channel
Operational

Fields #

NameDescription
target UnicodeString
protocol UInt16
port UInt16
authentication UInt16
usessl Boolean
skipcacheck Boolean
skipcncheck Boolean
skiprevocationcheck Boolean
timeoutsec UInt32

Event ID 18: Starts ModifyPersistentBootConfigOrder

#
Channel
Analytic

Event ID 19: Stops ModifyPersistentBootConfigOrder

#
Channel
Analytic

Event ID 20: Starts ChangeBootConfiguration

#
Channel
Analytic

Event ID 21: Stops ChangeBootConfiguration

#
Channel
Analytic

Event ID 22: Starts ChangeNetworkConfiguration

#
Channel
Analytic

Event ID 23: Stops ChangeNetworkConfiguration

#
Channel
Analytic

Event ID 24: Starts ChangeUserPassword

#
Channel
Analytic

Event ID 25: Stops ChangeUserPassword

#
Channel
Analytic

Event ID 26: Starts getting PCSV device log

#
Channel
Analytic

Event ID 27: Stops getting PCSV device log

#
Channel
Analytic

Event ID 28: Starts clearing PCSV device log

#
Channel
Analytic

Event ID 29: Stops clearing PCSV device log

#
Channel
Analytic

Event ID 30: The request data for in-band IPMI request NetFn.

#
Channel
Analytic

Message #

The request data for in-band IPMI request %1

Fields #

NameDescription
NetFn UInt8
CommandID UInt8
PacketSize UInt32
PacketData Binary
SessionId UInt32
SequenceNumber UInt32

Event ID 31: The response data for in-band IPMI request NetFn.

#
Channel
Analytic

Message #

The response data for in-band IPMI request %1

Fields #

NameDescription
NetFn UInt8
CommandID UInt8
PacketSize UInt32
PacketData Binary
SessionId UInt32
SequenceNumber UInt32

Provenance

ETW provider GUID 7e87506f-bace-4bf1-bc09-3a1f37045c71

Defined in pcsvDevice.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB