Microsoft-Windows-DriverFrameworks-UserMode

77 events across 4 channels

Event	Title	Channel	Sample
1000	The Driver Manager service started successfully	Operational	Y
1001	The Driver Manager service failed to start.	Operational	N
1002	The Driver Manager service was stopped	Operational	N
1003	The Driver Manager service is starting a host process for device …	Operational	Y
1004	The host process (UMDFDriverManagerHostCreateEnd.LifetimeId) started …	Operational	Y
1005	The host process (LifetimeId) failed to start successfully.	Operational	N
1006	The host process (UMDFDriverManagerHostShutdown.LifetimeId) is being asked to …	Operational	Y
1007	The host process (LifetimeId) has a problem (Problem) and is being terminated.	Operational	Y
1008	The host process (UMDFDriverManagerHostShutdown.LifetimeId) has been shutdown.	Operational	Y
1009	The host process (LifetimeId) has a problem (Problem) and is being terminated.	Operational	N
2000	The UMDF Host Process (UMDFHostStartupBegin.LifetimeId) is starting up.	Operational	Y
2001	The UMDF Host Process (UMDFHostStartupEnd.LifetimeId) started successfully.	Operational	Y
2002	The UMDF Host Process (LifetimeId) failed to start successfully.	Operational	N
2003	The UMDF Host Process (UMDFHostDeviceArrivalBegin.LifetimeId) has been asked to …	Operational	Y
2004	The UMDF Host is loading driver UMDFHostAddDeviceBegin.Service at level …	Operational	Y
2005	The UMDF Host Process (UMDFHostModuleLoad.LifetimeId) has loaded module …	Operational	Y
2006	The UMDF Host successfully loaded the driver at level …	Operational	Y
2007	The UMDF Host failed to load the driver at level Level.	Operational	N
2010	The UMDF Host Process (UMDFHostDeviceArrivalEnd.LifetimeId) has successfully …	Operational	Y
2011	The UMDF Host Process (LifetimeId) has failed to load drivers for device …	Operational	N
2100	Received a Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, …	Operational	Y
2101	Completed a Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, …	Operational	Y
2102	Forwarded a finished Pnp or Power operation …	Operational	Y
2103	Completed a Pnp or Power operation (MajorCode, MinorCode) for device InstanceId …	Operational	N
2105	Forwarded a Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, …	Operational	Y
2106	Received a Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, …	Operational	Y
2107	Received a Pnp or Power operation (MajorCode, MinorCode) for device InstanceId …	Operational	N
2900	The UMDF Host (UMDFHostShutdown.LifetimeId) has been asked to shutdown.	Operational	Y
2901	The UMDF Host (UMDFHostShutdown.LifetimeId) has shutdown.	Operational	Y
3000	UMDF State Machine StateMachine start processing event Event (Queueing …	Operational	N
3001	UMDF State Machine StateMachine dropped event Event.	Operational	N
3010	UMDF State Machine StateMachine state change from CurrentState to NewState on …	Operational	N
3011	UMDF State Machine StateMachine event processing finished in state CurrentState.	Operational	N
3020	UMDF State Machine StateMachine event processing stopped in state Event.	Operational	N
4000	A runtime failure has occurred in user-mode driver Driver and the hosting …	Operational	N
10000	A driver package which uses user-mode driver framework version …	System	Y
10001	The UMDF service UMDFServiceInstall.ServiceName (CLSID UMDFServiceInstall.CLSID) …	System	Y
10002	The UMDF service ServiceName (CLSID CLSID) was upgraded.	System	N
10100	The driver package installation has succeeded.	System	Y
10101	The driver package installation has failed.	System	N
10110	A problem has occurred with one or more user-mode drivers and the hosting …	System	Y
10111	The device FriendlyName (location Location) is offline due to a user-mode driver …	System	Y
10112	The device FriendlyName (location Location) is offline due to a user-mode device …	System	N
10113	The device InstanceId was unable to start due to conflict between the settings …	System	N
10114	{UnstartedService} (part of UMDF) did not load yet.	System	N
10115	The device FriendlyName (location Location) is offline due to a user-mode driver …	System	N
10116	The device FriendlyName (location Location) is offline due to a user-mode driver …	System	N
10117	UMDF driver service ServiceName failed to load because it was compiled using a …	System	N
10118	UMDF reflector is unable to connect to service control manager (SCM).	System	N
10120	A problem has occurred with one or more user-mode drivers and the hosting …	System	N
10121	A runtime failure has occurred in user-mode driver Driver and the hosting …	System	N
19999	UMDF Test Event (String).	System	N
20030	Power IRP related event in the User-mode Driver Frameworks Host Process	Diagnostic	N
20031	Power IRP related event in the User-mode Driver Frameworks Host Process	Diagnostic	N
20032	Power IRP related event in the User-mode Driver Frameworks Host Process	Diagnostic	N
20033	Power IRP related event in the User-mode Driver Frameworks Host Process	Diagnostic	N
30000	A driver package which uses user-mode driver framework version …	Operational	N
30001	The driver package installation has finished.	Operational	N
30002	PreDevice installation (UMDF version {FrameworkVersion}) is starting for device …	Operational	N
30003	PreDevice installation has finished.	Operational	N
30004	PostDevice installation (UMDF version {FrameworkVersion}) is starting for device …	Operational	N
30005	PostDevice installation has finished.	Operational	N
30007	UMDF has been updated.	Operational	N
30008	DDI to read from hardware begins (TargetType: HwAccessTargetType, TargetSize: …	Operational	N
30009	DDI to read from hardware ends (TargetType: HwAccessTargetType, TargetSize: …	Operational	N
30010	Read from hardware begins (TargetType: HwAccessTargetType, TargetSize: …	Operational	N
30011	Read from hardware ends (TargetType: HwAccessTargetType, TargetSize: …	Operational	N
30012	DDI to write to hardware begins (TargetType: HwAccessTargetType, TargetSize: …	Operational	N
30013	DDI to write to hardware ends (TargetType: HwAccessTargetType, TargetSize: …	Operational	N
30014	Write to hardware begins (TargetType: HwAccessTargetType, TargetSize: …	Operational	N
30015	Write to hardware ends (TargetType: HwAccessTargetType, TargetSize: …	Operational	N
30016	Read from hardware begins (TargetType: HwAccessTargetType, TargetSize: …	Operational	N
30017	Read from hardware ends (TargetType: HwAccessTargetType, TargetSize: …	Operational	N
30018	Write to hardware begins (TargetType: HwAccessTargetType, TargetSize: …	Operational	N
30019	Write to hardware ends (TargetType: HwAccessTargetType, TargetSize: …	Operational	N
30020	UMDF Reflector sent notification for hardware interrupt (Message ID …	Operational	N
30021	UMDF framework received notification for hardware interrupt (Message ID …	Operational	N

Event ID 1000: The Driver Manager service started successfully

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Informational
Task: Startupofthedrivermanagerservice.
Opcode: Start

Description

The Driver Manager service started successfully.

Message #

The Driver Manager service started successfully

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 1000,
    "version": 2,
    "level": 4,
    "task": 16,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:05:02.700509+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 656,
      "thread_id": 692
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 1001: The Driver Manager service failed to start.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: Startupofthedrivermanagerservice.
Opcode: Stop

Description

The Driver Manager service failed to start. The error reported was %2.

Message #

The Driver Manager service failed to start.  The error reported was %2.

Fields #

Name	Description
`Error` UInt32

Event ID 1002: The Driver Manager service was stopped

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: Startupofthedrivermanagerservice.
Opcode: Stop

Description

The Driver Manager service was stopped.

Message #

The Driver Manager service was stopped

Event ID 1003: The Driver Manager service is starting a host process for device UMDFDriverManagerHostCreateStart.DeviceInstanceId.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Informational
Task: Creationofanewdriverhostprocess.
Opcode: Start

Description

The Driver Manager service is starting a host process for device UMDFDriverManagerHostCreateStart.DeviceInstanceId.

Message #

The Driver Manager service is starting a host process for device %3.

Fields #

Name	Description
`LifetimeId` GUID
`HostGuid` UnicodeString
`InstanceId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 1003,
    "version": 1,
    "level": 4,
    "task": 17,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:00:23.938852+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 928,
      "thread_id": 608
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "UMDFDriverManagerHostCreateStart": {
      "LifetimeId": "3D69498E-0D29-42F1-905E-33C3A505E322",
      "HostGuid": "{193a1820-d9ac-4997-8c55-be817523f6aa}",
      "DeviceInstanceId": "SWD.REMOTEDISPLAYENUM.RDPIDD_INDIRECTDISPLAY&SESSIONID_0001"
    }
  },
  "message": ""
}

Event ID 1004: The host process (UMDFDriverManagerHostCreateEnd.LifetimeId) started successfully.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Informational
Task: Creationofanewdriverhostprocess.
Opcode: Stop

Description

The host process (UMDFDriverManagerHostCreateEnd.LifetimeId) started successfully.

Message #

The host process (%1) started successfully.

Fields #

Name	Description
`LifetimeId` GUID
`FinalStatus` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 1004,
    "version": 1,
    "level": 4,
    "task": 17,
    "opcode": 2,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:00:23.989889+00:00",
    "event_record_id": 5,
    "correlation": {},
    "execution": {
      "process_id": 928,
      "thread_id": 608
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "UMDFDriverManagerHostCreateEnd": {
      "LifetimeId": "3D69498E-0D29-42F1-905E-33C3A505E322",
      "FinalStatus": 0
    }
  },
  "message": ""
}

Event ID 1005: The host process (LifetimeId) failed to start successfully.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: Creationofanewdriverhostprocess.
Opcode: Stop

Description

The host process (LifetimeId) failed to start successfully. The error reported was FinalStatus.

Message #

The host process (%1) failed to start successfully.  The error reported was %2.

Fields #

Name	Description
`LifetimeId` GUID
`FinalStatus` UInt32

Event ID 1006: The host process (UMDFDriverManagerHostShutdown.LifetimeId) is being asked to shutdown.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Informational
Task: Shutdownofadriverhostprocess.
Opcode: Start

Description

The host process (UMDFDriverManagerHostShutdown.LifetimeId) is being asked to shutdown.

Message #

The host process (%1) is being asked to shutdown.

Fields #

Name	Description
`LifetimeId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 1006,
    "version": 1,
    "level": 4,
    "task": 18,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:03:23.476353+00:00",
    "event_record_id": 56,
    "correlation": {},
    "execution": {
      "process_id": 656,
      "thread_id": 1112
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "UMDFDriverManagerHostShutdown": {
      "LifetimeId": "2E824AC4-1BF6-49DF-A55C-C63302D85A3E"
    }
  },
  "message": ""
}

Event ID 1007: The host process (LifetimeId) has a problem (Problem) and is being terminated.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Error
Task: Shutdownofadriverhostprocess.

Description

The host process (LifetimeId) has a problem (Problem) and is being terminated.

Message #

The host process (%1) has a problem (%2) and is being terminated.

Fields #

Name	Description
`UMDFHostProblem.LifetimeId` GUID
`UMDFHostProblem.Problem` UInt8
`UMDFHostProblem.DetectedBy` UInt8
`UMDFHostProblem.ActiveOperation` UInt8
`UMDFHostProblem.ExitCode` UInt32
`UMDFHostProblem.Message` UInt32
`UMDFHostProblem.Status` UInt32	NTSTATUS reference
`LifetimeId` GUID
`Problem` UInt8
`DetectedBy` UInt8
`ActiveOperation` UInt8
`ExitCode` UInt32
`Message` UInt32
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "{2E35AAEB-857F-4BEB-A418-2E6C0E54D988}",
    "event_source_name": "",
    "event_id": 1007,
    "version": 1,
    "level": 2,
    "task": 18,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-04-15T21:23:59.3708593+00:00",
    "event_record_id": 4046,
    "correlation": {},
    "execution": {
      "process_id": 1040,
      "thread_id": 1184
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "UMDFHostProblem": {
      "LifetimeId": "{d2ed148d-92b3-4630-b3ae-32cd0fdc873c}",
      "Problem": "8",
      "DetectedBy": "2",
      "ActiveOperation": "0",
      "ExitCode": "1879048193",
      "Message": "0",
      "Status": "4294967295"
    }
  },
  "message": "The host process ({d2ed148d-92b3-4630-b3ae-32cd0fdc873c}) has a problem (8) and is being terminated."
}

Event ID 1008: The host process (UMDFDriverManagerHostShutdown.LifetimeId) has been shutdown.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Informational
Task: Shutdownofadriverhostprocess.
Opcode: Stop

Description

The host process (UMDFDriverManagerHostShutdown.LifetimeId) has been shutdown.

Message #

The host process (%1) has been shutdown.

Fields #

Name	Description
`LifetimeId` GUID
`TerminationStatus` UInt32
`ExitCode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 1008,
    "version": 1,
    "level": 4,
    "task": 18,
    "opcode": 2,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:03:23.482031+00:00",
    "event_record_id": 59,
    "correlation": {},
    "execution": {
      "process_id": 656,
      "thread_id": 1112
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "UMDFDriverManagerHostShutdown": {
      "LifetimeId": "2E824AC4-1BF6-49DF-A55C-C63302D85A3E",
      "TerminateStatus": 0,
      "ExitCode": 0
    }
  },
  "message": ""
}

Event ID 1009: The host process (LifetimeId) has a problem (Problem) and is being terminated.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: Shutdownofadriverhostprocess.

Description

The host process (LifetimeId) has a problem (Problem) and is being terminated.

Message #

The host process (%1) has a problem (%2) and is being terminated.

Fields #

Name	Description
`LifetimeId` GUID
`Problem` UInt8
`DetectedBy` UInt8
`ActiveOperation` UInt8
`ExitCode` UInt32
`Message` UInt32
`Status` UInt32	NTSTATUS reference
`InstanceId` UnicodeString
`HardwareId` UnicodeString
`ServiceName` UnicodeString

Event ID 2000: The UMDF Host Process (UMDFHostStartupBegin.LifetimeId) is starting up.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Informational
Task: Startupofanewdriverhostprocess.
Opcode: Start

Description

The UMDF Host Process (UMDFHostStartupBegin.LifetimeId) is starting up.

Message #

The UMDF Host Process (%1) is starting up.

Fields #

Name	Description
`LifetimeId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 2000,
    "version": 1,
    "level": 4,
    "task": 32,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:00:23.973052+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 8116,
      "thread_id": 3552
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "user_data": {
    "UMDFHostStartupBegin": {
      "LifetimeId": "3D69498E-0D29-42F1-905E-33C3A505E322"
    }
  },
  "message": ""
}

Event ID 2001: The UMDF Host Process (UMDFHostStartupEnd.LifetimeId) started successfully.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Informational
Task: Startupofanewdriverhostprocess.
Opcode: Stop

Description

The UMDF Host Process (UMDFHostStartupEnd.LifetimeId) started successfully.

Message #

The UMDF Host Process (%1) started successfully.

Fields #

Name	Description
`LifetimeId` GUID
`ExitCode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 2001,
    "version": 1,
    "level": 4,
    "task": 32,
    "opcode": 2,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:00:23.978254+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 8116,
      "thread_id": 3552
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "user_data": {
    "UMDFHostStartupEnd": {
      "LifetimeId": "3D69498E-0D29-42F1-905E-33C3A505E322",
      "FinalStatus": 0
    }
  },
  "message": ""
}

Event ID 2002: The UMDF Host Process (LifetimeId) failed to start successfully.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: Startupofanewdriverhostprocess.
Opcode: Stop

Description

The UMDF Host Process (LifetimeId) failed to start successfully. The error reported was ExitCode.

Message #

The UMDF Host Process (%1) failed to start successfully.  The error reported was %2.

Fields #

Name	Description
`LifetimeId` GUID
`ExitCode` UInt32

Event ID 2003: The UMDF Host Process (UMDFHostDeviceArrivalBegin.LifetimeId) has been asked to load drivers for device UMDFHostDeviceArrivalBegin.InstanceId.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Informational
Collection Priority: Recommended (ANSSI)
Task: Loadingdriverstocontrolanewlydiscovereddevice.
Opcode: Start

Description

The UMDF Host Process (UMDFHostDeviceArrivalBegin.LifetimeId) has been asked to load drivers for device UMDFHostDeviceArrivalBegin.InstanceId.

Message #

The UMDF Host Process (%1) has been asked to load drivers for device %2.

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 2003,
    "version": 1,
    "level": 4,
    "task": 33,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:00:23.998527+00:00",
    "event_record_id": 6,
    "correlation": {},
    "execution": {
      "process_id": 8116,
      "thread_id": 7760
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "user_data": {
    "UMDFHostDeviceArrivalBegin": {
      "LifetimeId": "3D69498E-0D29-42F1-905E-33C3A505E322",
      "InstanceId": "SWD\\REMOTEDISPLAYENUM\\RDPIDD_INDIRECTDISPLAY&SESSIONID_0001"
    }
  },
  "message": ""
}

Detection Patterns #

Initial Access: Hardware Additions

DriverFrameworks-UserMode Event ID 2003: The UMDF Host Process (UMDFHostDeviceArrivalBegin.LifetimeId) has been asked to load drivers for device UMDFHostDeviceArrivalBegin.InstanceId.OREvent ID 2100: Received a Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, UMDFHostDeviceRequest.RequestMinorCode) for device UMDFHostDeviceRequest.InstanceId.OREvent ID 2102: Forwarded a finished Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, UMDFHostDeviceRequest.RequestMinorCode) to the lower driver for device UMDFHostDeviceRequest.InstanceId with status UMDFHostDeviceRequest.Status.

1 rule

Sigma

USB Device Plugged (source)

Florian Roth (Nextron Systems)

Event ID 2004: The UMDF Host is loading driver UMDFHostAddDeviceBegin.Service at level UMDFHostAddDeviceBegin.Level for device UMDFHostAddDeviceBegin.InstanceId.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Verbose
Collection Priority: Recommended (Microsoft-WEF, others)
Task: Loadingdriverstocontrolanewlydiscovereddevice.
Opcode: Start

Description

The UMDF Host is loading driver UMDFHostAddDeviceBegin.Service at level UMDFHostAddDeviceBegin.Level for device UMDFHostAddDeviceBegin.InstanceId.

Message #

The UMDF Host is loading driver %4 at level %3 for device %2.

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`Level` UInt32
`Service` UnicodeString
`ClsId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 2004,
    "version": 1,
    "level": 5,
    "task": 33,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:00:23.998872+00:00",
    "event_record_id": 8,
    "correlation": {},
    "execution": {
      "process_id": 8116,
      "thread_id": 7760
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "user_data": {
    "UMDFHostAddDeviceBegin": {
      "LifetimeId": "3D69498E-0D29-42F1-905E-33C3A505E322",
      "InstanceId": "SWD\\REMOTEDISPLAYENUM\\RDPIDD_INDIRECTDISPLAY&SESSIONID_0001",
      "Level": 0,
      "Service": "RdpIdd",
      "DriverClsid": "00000000-0000-0000-0000-000000000000"
    }
  },
  "message": ""
}

Event ID 2005: The UMDF Host Process (UMDFHostModuleLoad.LifetimeId) has loaded module UMDFHostModuleLoad.ModulePath while loading drivers for device UMDFHostModuleLoad.InstanceId.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Verbose
Task: Loadingdriverstocontrolanewlydiscovereddevice.

Description

The UMDF Host Process (UMDFHostModuleLoad.LifetimeId) has loaded module UMDFHostModuleLoad.ModulePath while loading drivers for device UMDFHostModuleLoad.InstanceId.

Message #

The UMDF Host Process (%1) has loaded module %3 while loading drivers for device %2.

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`ModulePath` UnicodeString
`CompanyName` UnicodeString
`FileDescription` UnicodeString
`FileVersion` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 2005,
    "version": 1,
    "level": 5,
    "task": 33,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:00:24.104813+00:00",
    "event_record_id": 9,
    "correlation": {},
    "execution": {
      "process_id": 8116,
      "thread_id": 7760
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "user_data": {
    "UMDFHostModuleLoad": {
      "LifetimeId": "3D69498E-0D29-42F1-905E-33C3A505E322",
      "InstanceId": "NULL",
      "ModulePath": "C:\\Windows\\System32\\WUDFx02000.dll",
      "CompanyName": "Microsoft Corporation",
      "FileDescription": "WDF:UMDF Framework Library",
      "FileVersion": "10.0.20348.1 (WinBuild.160101.0800)"
    }
  },
  "message": ""
}

Event ID 2006: The UMDF Host successfully loaded the driver at level UMDFHostAddDeviceEnd.Level.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Verbose
Collection Priority: Recommended (ANSSI)
Task: Loadingdriverstocontrolanewlydiscovereddevice.
Opcode: Stop

Description

The UMDF Host successfully loaded the driver at level UMDFHostAddDeviceEnd.Level.

Message #

The UMDF Host successfully loaded the driver at level %3.

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`Level` UInt32
`FinalStatus` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 2006,
    "version": 1,
    "level": 5,
    "task": 33,
    "opcode": 2,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:00:24.154881+00:00",
    "event_record_id": 27,
    "correlation": {},
    "execution": {
      "process_id": 8116,
      "thread_id": 7760
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "user_data": {
    "UMDFHostAddDeviceEnd": {
      "LifetimeId": "3D69498E-0D29-42F1-905E-33C3A505E322",
      "InstanceId": "SWD\\REMOTEDISPLAYENUM\\RDPIDD_INDIRECTDISPLAY&SESSIONID_0001",
      "Level": 0,
      "FinalStatus": 0
    }
  },
  "message": ""
}

Event ID 2007: The UMDF Host failed to load the driver at level Level.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: Loadingdriverstocontrolanewlydiscovereddevice.
Opcode: Stop

Description

The UMDF Host failed to load the driver at level Level. The error reported was FinalStatus.

Message #

The UMDF Host failed to load the driver at level %3.  The error reported was %4.

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`Level` UInt32
`FinalStatus` UInt32

Event ID 2010: The UMDF Host Process (UMDFHostDeviceArrivalEnd.LifetimeId) has successfully loaded drivers for device UMDFHostDeviceArrivalEnd.InstanceId.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Informational
Collection Priority: Recommended (ANSSI)
Task: Loadingdriverstocontrolanewlydiscovereddevice.
Opcode: Stop

Description

The UMDF Host Process (UMDFHostDeviceArrivalEnd.LifetimeId) has successfully loaded drivers for device UMDFHostDeviceArrivalEnd.InstanceId.

Message #

The UMDF Host Process (%1) has successfully loaded drivers for device %2.

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`FinalStatus` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 2010,
    "version": 1,
    "level": 4,
    "task": 33,
    "opcode": 2,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:00:23.998782+00:00",
    "event_record_id": 7,
    "correlation": {},
    "execution": {
      "process_id": 8116,
      "thread_id": 7760
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "user_data": {
    "UMDFHostDeviceArrivalEnd": {
      "LifetimeId": "3D69498E-0D29-42F1-905E-33C3A505E322",
      "InstanceId": "SWD\\REMOTEDISPLAYENUM\\RDPIDD_INDIRECTDISPLAY&SESSIONID_0001",
      "FinalStatus": 0
    }
  },
  "message": ""
}

Event ID 2011: The UMDF Host Process (LifetimeId) has failed to load drivers for device InstanceId.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: Loadingdriverstocontrolanewlydiscovereddevice.
Opcode: Stop

Description

The UMDF Host Process (LifetimeId) has failed to load drivers for device InstanceId. The error reported was FinalStatus.

Message #

The UMDF Host Process (%1) has failed to load drivers for device %2.  The error reported was %3

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`FinalStatus` UInt32

Event ID 2100: Received a Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, UMDFHostDeviceRequest.RequestMinorCode) for device UMDFHostDeviceRequest.InstanceId.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Informational
Collection Priority: Recommended (ANSSI)
Task: PnporPowerManagementoperationtoaparticulardevice.
Opcode: Start

Description

Received a Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, UMDFHostDeviceRequest.RequestMinorCode) for device UMDFHostDeviceRequest.InstanceId.

Message #

Received a Pnp or Power operation (%3, %4) for device %2.

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`MajorCode` UInt8
`MinorCode` UInt8
`Argument1` Pointer
`Argument2` Pointer
`Argument3` Pointer
`Argument4` Pointer
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 2100,
    "version": 1,
    "level": 4,
    "task": 37,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:00:24.156732+00:00",
    "event_record_id": 28,
    "correlation": {},
    "execution": {
      "process_id": 8116,
      "thread_id": 7940
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "user_data": {
    "UMDFHostDeviceRequest": {
      "LifetimeId": "3D69498E-0D29-42F1-905E-33C3A505E322",
      "InstanceId": "SWD\\REMOTEDISPLAYENUM\\RDPIDD_INDIRECTDISPLAY&SESSIONID_0001",
      "RequestMajorCode": 27,
      "RequestMinorCode": 9,
      "Argument1": "0x10040",
      "Argument2": "0xffffffffffffffff",
      "Argument3": "0x0",
      "Argument4": "0x0",
      "Status": 3221225659
    }
  },
  "message": ""
}

Detection Patterns #

Initial Access: Hardware Additions

1 rule

Sigma

USB Device Plugged (source)

Florian Roth (Nextron Systems)

Event ID 2101: Completed a Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, UMDFHostDeviceRequest.RequestMinorCode) for device UMDFHostDeviceRequest.InstanceId with status UMDFHostDeviceRequest.Sta...

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Informational
Collection Priority: Recommended (ANSSI)
Task: PnporPowerManagementoperationtoaparticulardevice.
Opcode: Stop

Description

Completed a Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, UMDFHostDeviceRequest.RequestMinorCode) for device UMDFHostDeviceRequest.InstanceId with status UMDFHostDeviceRequest.Status.

Message #

Completed a Pnp or Power operation (%3, %4) for device %2 with status %9.

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`MajorCode` UInt8
`MinorCode` UInt8
`Argument1` Pointer
`Argument2` Pointer
`Argument3` Pointer
`Argument4` Pointer
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 2101,
    "version": 1,
    "level": 4,
    "task": 37,
    "opcode": 2,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:00:24.156878+00:00",
    "event_record_id": 31,
    "correlation": {},
    "execution": {
      "process_id": 8116,
      "thread_id": 7940
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "user_data": {
    "UMDFHostDeviceRequest": {
      "LifetimeId": "3D69498E-0D29-42F1-905E-33C3A505E322",
      "InstanceId": "SWD\\REMOTEDISPLAYENUM\\RDPIDD_INDIRECTDISPLAY&SESSIONID_0001",
      "RequestMajorCode": 27,
      "RequestMinorCode": 9,
      "Argument1": "0x2d000010040",
      "Argument2": "0xffffffffffffffff",
      "Argument3": "0x100000000",
      "Argument4": "0x400000004",
      "Status": 0
    }
  },
  "message": ""
}

Event ID 2102: Forwarded a finished Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, UMDFHostDeviceRequest.RequestMinorCode) to the lower driver for device UMDFHostDeviceRequest.InstanceId with sta...

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Informational
Task: PnporPowerManagementoperationtoaparticulardevice.
Opcode: Stop

Description

Forwarded a finished Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, UMDFHostDeviceRequest.RequestMinorCode) to the lower driver for device UMDFHostDeviceRequest.InstanceId with status UMDFHostDeviceRequest.Status.

Message #

Forwarded a finished Pnp or Power operation (%3, %4) to the lower driver for device %2 with status %9.

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`MajorCode` UInt8
`MinorCode` UInt8
`Argument1` Pointer
`Argument2` Pointer
`Argument3` Pointer
`Argument4` Pointer
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 2102,
    "version": 1,
    "level": 4,
    "task": 37,
    "opcode": 2,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:03:23.459717+00:00",
    "event_record_id": 53,
    "correlation": {},
    "execution": {
      "process_id": 6928,
      "thread_id": 6020
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "user_data": {
    "UMDFHostDeviceRequest": {
      "LifetimeId": "2E824AC4-1BF6-49DF-A55C-C63302D85A3E",
      "InstanceId": "SWD\\REMOTEDISPLAYENUM\\RDPIDD_INDIRECTDISPLAY&SESSIONID_0001",
      "RequestMajorCode": 27,
      "RequestMinorCode": 23,
      "Argument1": "0x0",
      "Argument2": "0x0",
      "Argument3": "0x0",
      "Argument4": "0x0",
      "Status": 0
    }
  },
  "message": ""
}

Detection Patterns #

Initial Access: Hardware Additions

1 rule

Sigma

USB Device Plugged (source)

Florian Roth (Nextron Systems)

Event ID 2103: Completed a Pnp or Power operation (MajorCode, MinorCode) for device InstanceId with status Status.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: PnporPowerManagementoperationtoaparticulardevice.
Opcode: Stop

Description

Completed a Pnp or Power operation (MajorCode, MinorCode) for device InstanceId with status Status.

Message #

Completed a Pnp or Power operation (%3, %4) for device %2 with status %9.

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`MajorCode` UInt8
`MinorCode` UInt8
`Argument1` Pointer
`Argument2` Pointer
`Argument3` Pointer
`Argument4` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 2105: Forwarded a Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, UMDFHostDeviceRequest.RequestMinorCode) for device UMDFHostDeviceRequest.InstanceId to the lower driver with status UMDFH...

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Informational
Collection Priority: Recommended (ANSSI)
Task: PnporPowerManagementoperationtoaparticulardevice.
Opcode: Start

Description

Forwarded a Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, UMDFHostDeviceRequest.RequestMinorCode) for device UMDFHostDeviceRequest.InstanceId to the lower driver with status UMDFHostDeviceRequest.Status.

Message #

Forwarded a Pnp or Power operation (%3, %4) for device %2 to the lower driver with status %9

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`MajorCode` UInt8
`MinorCode` UInt8
`Argument1` Pointer
`Argument2` Pointer
`Argument3` Pointer
`Argument4` Pointer
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 2105,
    "version": 1,
    "level": 4,
    "task": 37,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:00:24.156800+00:00",
    "event_record_id": 29,
    "correlation": {},
    "execution": {
      "process_id": 8116,
      "thread_id": 7940
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "user_data": {
    "UMDFHostDeviceRequest": {
      "LifetimeId": "3D69498E-0D29-42F1-905E-33C3A505E322",
      "InstanceId": "SWD\\REMOTEDISPLAYENUM\\RDPIDD_INDIRECTDISPLAY&SESSIONID_0001",
      "RequestMajorCode": 27,
      "RequestMinorCode": 9,
      "Argument1": "0x10040",
      "Argument2": "0xffffffffffffffff",
      "Argument3": "0x0",
      "Argument4": "0x0",
      "Status": 3221225659
    }
  },
  "message": ""
}

Event ID 2106: Received a Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, UMDFHostDeviceRequest.RequestMinorCode) for device UMDFHostDeviceRequest.InstanceId which was completed by the lower drive...

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Informational
Collection Priority: Recommended (ANSSI)
Task: PnporPowerManagementoperationtoaparticulardevice.
Opcode: Start

Description

Received a Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, UMDFHostDeviceRequest.RequestMinorCode) for device UMDFHostDeviceRequest.InstanceId which was completed by the lower drivers with status UMDFHostDeviceRequest.Status.

Message #

Received a Pnp or Power operation (%3, %4) for device %2 which was completed by the lower drivers with status %9

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`MajorCode` UInt8
`MinorCode` UInt8
`Argument1` Pointer
`Argument2` Pointer
`Argument3` Pointer
`Argument4` Pointer
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 2106,
    "version": 1,
    "level": 4,
    "task": 37,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:00:24.156869+00:00",
    "event_record_id": 30,
    "correlation": {},
    "execution": {
      "process_id": 8116,
      "thread_id": 7940
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "user_data": {
    "UMDFHostDeviceRequest": {
      "LifetimeId": "3D69498E-0D29-42F1-905E-33C3A505E322",
      "InstanceId": "SWD\\REMOTEDISPLAYENUM\\RDPIDD_INDIRECTDISPLAY&SESSIONID_0001",
      "RequestMajorCode": 27,
      "RequestMinorCode": 9,
      "Argument1": "0x10040",
      "Argument2": "0xffffffffffffffff",
      "Argument3": "0x0",
      "Argument4": "0x0",
      "Status": 0
    }
  },
  "message": ""
}

Event ID 2107: Received a Pnp or Power operation (MajorCode, MinorCode) for device InstanceId which was completed by the lower drivers with status Status.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: PnporPowerManagementoperationtoaparticulardevice.
Opcode: Start

Description

Received a Pnp or Power operation (MajorCode, MinorCode) for device InstanceId which was completed by the lower drivers with status Status.

Message #

Received a Pnp or Power operation (%3, %4) for device %2 which was completed by the lower drivers with status %9

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`MajorCode` UInt8
`MinorCode` UInt8
`Argument1` Pointer
`Argument2` Pointer
`Argument3` Pointer
`Argument4` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 2900: The UMDF Host (UMDFHostShutdown.LifetimeId) has been asked to shutdown.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Informational
Task: Shutdownofadriverhostprocess._41
Opcode: Start

Description

The UMDF Host (UMDFHostShutdown.LifetimeId) has been asked to shutdown.

Message #

The UMDF Host (%1) has been asked to shutdown.

Fields #

Name	Description
`LifetimeId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 2900,
    "version": 1,
    "level": 4,
    "task": 41,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:03:23.476446+00:00",
    "event_record_id": 57,
    "correlation": {},
    "execution": {
      "process_id": 6928,
      "thread_id": 6020
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "user_data": {
    "UMDFHostShutdown": {
      "LifetimeId": "2E824AC4-1BF6-49DF-A55C-C63302D85A3E"
    }
  },
  "message": ""
}

Event ID 2901: The UMDF Host (UMDFHostShutdown.LifetimeId) has shutdown.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Level: Informational
Task: Shutdownofadriverhostprocess._41
Opcode: Stop

Description

The UMDF Host (UMDFHostShutdown.LifetimeId) has shutdown.

Message #

The UMDF Host (%1) has shutdown.

Fields #

Name	Description
`LifetimeId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 2901,
    "version": 1,
    "level": 4,
    "task": 41,
    "opcode": 2,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:03:23.477062+00:00",
    "event_record_id": 58,
    "correlation": {},
    "execution": {
      "process_id": 6928,
      "thread_id": 8256
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "user_data": {
    "UMDFHostShutdown": {
      "LifetimeId": "2E824AC4-1BF6-49DF-A55C-C63302D85A3E"
    }
  },
  "message": ""
}

Event ID 3000: UMDF State Machine StateMachine start processing event Event (Queueing Queueing).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: PnporPowerManagementoperationtoaparticulardriverinadevicestack.
Opcode: Start

Description

UMDF State Machine StateMachine start processing event Event (Queueing Queueing).

Message #

UMDF State Machine %4 start processing event %5 (Queueing %6)

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`Level` UInt32
`StateMachine` UInt8
`Event` UInt32
`Queueing` UInt32

Event ID 3001: UMDF State Machine StateMachine dropped event Event.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: PnporPowerManagementoperationtoaparticulardriverinadevicestack.

Description

UMDF State Machine StateMachine dropped event Event.

Message #

UMDF State Machine %4 dropped event %5

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`Level` UInt32
`StateMachine` UInt8
`Event` UInt32

Event ID 3010: UMDF State Machine StateMachine state change from CurrentState to NewState on event Event.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: PnporPowerManagementoperationtoaparticulardriverinadevicestack.
Opcode: Start

Description

UMDF State Machine StateMachine state change from CurrentState to NewState on event Event.

Message #

UMDF State Machine %4 state change from %5 to %7 on event %6

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`Level` UInt32
`StateMachine` UInt32
`CurrentState` UInt32
`Event` UInt32
`NewState` UInt32

Event ID 3011: UMDF State Machine StateMachine event processing finished in state CurrentState.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: PnporPowerManagementoperationtoaparticulardriverinadevicestack.
Opcode: Stop

Description

UMDF State Machine StateMachine event processing finished in state CurrentState.

Message #

UMDF State Machine %4 event processing finished in state %5

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`Level` UInt32
`StateMachine` UInt8
`CurrentState` UInt32

Event ID 3020: UMDF State Machine StateMachine event processing stopped in state Event.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: PnporPowerManagementoperationtoaparticulardriverinadevicestack.
Opcode: Stop

Description

UMDF State Machine StateMachine event processing stopped in state Event.

Message #

UMDF State Machine %4 event processing stopped in state %5

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`Level` UInt32
`StateMachine` UInt8
`Event` UInt32

Event ID 4000: A runtime failure has occurred in user-mode driver Driver and the hosting process has been terminated.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: UMDFVerifierFailure.

Description

A runtime failure has occurred in user-mode driver Driver and the hosting process has been terminated. This may temporarily interrupt your ability to access the devices. Please contact the device manufacturer or driver vendor for more information about this problem.

Message #

A runtime failure has occurred in user-mode driver %5 and the hosting process has been terminated. This may temporarily interrupt your ability to access the devices. Please contact the device manufacturer or driver vendor for more information about this problem.

Fields #

Name	Description
`LifetimeId` GUID
`Category` UnicodeString
`ErrorNumber` HexInt64
`Location` UnicodeString
`Driver` UnicodeString
`ImageVersion` UnicodeString
`UMDFVersion` UnicodeString

Event ID 10000: A driver package which uses user-mode driver framework version UMDFDeviceInstallBegin.FrameworkVersion is being installed on device UMDFDeviceInstallBegin.DeviceId.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System
Level: Informational
Task: Installationorupdateofdevicedrivers.
Opcode: Start

Description

A driver package which uses user-mode driver framework version UMDFDeviceInstallBegin.FrameworkVersion is being installed on device UMDFDeviceInstallBegin.DeviceId.

Message #

A driver package which uses user-mode driver framework version %2 is being installed on device %1.

Fields #

Name	Description
`DeviceId`
`FrameworkVersion`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 10000,
    "version": 1,
    "level": 4,
    "task": 48,
    "opcode": 1,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T16:53:01.068372+00:00",
    "event_record_id": 375,
    "correlation": {},
    "execution": {
      "process_id": 2204,
      "thread_id": 4904
    },
    "channel": "System",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "UMDFDeviceInstallBegin": {
      "DeviceId": "SWD\\WPDBUSENUM\\_??_USBSTOR#DISK&VEN_VENDORCO&PROD_PRODUCTCODE&REV_2.00#9207032533193411390&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}",
      "FrameworkVersion": "2.33.0"
    }
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 10001: The UMDF service UMDFServiceInstall.ServiceName (CLSID UMDFServiceInstall.CLSID) was installed.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System
Level: Informational
Task: Installationorupdateofdevicedrivers.

Description

The UMDF service UMDFServiceInstall.ServiceName (CLSID UMDFServiceInstall.CLSID) was installed. It requires framework version UMDFServiceInstall.MinimumFxVersion or higher.

Message #

The UMDF service %1 (CLSID %2) was installed.  It requires framework version %3 or higher.

Fields #

Name	Description
`ServiceName`
`CLSID`
`FxVersion`
`Upgrade`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 10001,
    "version": 1,
    "level": 4,
    "task": 48,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T16:53:01.087249+00:00",
    "event_record_id": 376,
    "correlation": {},
    "execution": {
      "process_id": 2204,
      "thread_id": 4904
    },
    "channel": "System",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "UMDFServiceInstall": {
      "ServiceName": "WpdFs",
      "CLSID": "112DE495-AC4C-46F8-B663-6A4266C53313",
      "MinimumFxVersion": "2.33.0",
      "Upgrade": false
    }
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 10002: The UMDF service ServiceName (CLSID CLSID) was upgraded.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System
Task: Installationorupdateofdevicedrivers.

Description

The UMDF service ServiceName (CLSID CLSID) was upgraded. It requires framework version FxVersion or higher.

Message #

The UMDF service %1 (CLSID %2) was upgraded.  It requires framework version %3 or higher.

Fields #

Name	Description
`ServiceName` UnicodeString
`CLSID` GUID
`FxVersion` UnicodeString
`Upgrade` Boolean

Event ID 10100: The driver package installation has succeeded.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System
Level: Informational
Task: Installationorupdateofdevicedrivers.
Opcode: Stop

Description

The driver package installation has succeeded.

Message #

The driver package installation has succeeded.

Fields #

Name	Description
`FinalStatus`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 10100,
    "version": 1,
    "level": 4,
    "task": 48,
    "opcode": 2,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T16:53:01.102346+00:00",
    "event_record_id": 377,
    "correlation": {},
    "execution": {
      "process_id": 2204,
      "thread_id": 4904
    },
    "channel": "System",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "UMDFDeviceInstallEnd": {
      "FinalStatus": 0
    }
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 10101: The driver package installation has failed.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System
Task: Installationorupdateofdevicedrivers.
Opcode: Stop

Description

The driver package installation has failed. The final status was FinalStatus.

Message #

The driver package installation has failed.  The final status was %1.

Fields #

Name	Description
`FinalStatus` UInt32

Event ID 10110: A problem has occurred with one or more user-mode drivers and the hosting process has been terminated.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System
Level: Critical
Task: User_modeDriverproblems.

Description

A problem has occurred with one or more user-mode drivers and the hosting process has been terminated. This may temporarily interrupt your ability to access the devices.

Message #

A problem has occurred with one or more user-mode drivers and the hosting process has been terminated.  This may temporarily interrupt your ability to access the devices.

Fields #

Name	Description
`UMDFHostProblem.LifetimeId` GUID
`UMDFHostProblem.Problem` UInt8
`UMDFHostProblem.DetectedBy` UInt8
`UMDFHostProblem.ActiveOperation` UInt8
`UMDFHostProblem.ExitCode` UInt32
`UMDFHostProblem.Message` UInt32
`UMDFHostProblem.Status` UInt32	NTSTATUS reference
`LifetimeId` GUID
`Problem` UInt8
`DetectedBy` UInt8
`ActiveOperation` UInt8
`ExitCode` UInt32
`Message` UInt32
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "{2E35AAEB-857F-4BEB-A418-2E6C0E54D988}",
    "event_source_name": "",
    "event_id": 10110,
    "version": 1,
    "level": 1,
    "task": 64,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2026-04-15T21:23:59.3708761+00:00",
    "event_record_id": 5290,
    "correlation": {},
    "execution": {
      "process_id": 1040,
      "thread_id": 1184
    },
    "channel": "System",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "UMDFHostProblem": {
      "LifetimeId": "{d2ed148d-92b3-4630-b3ae-32cd0fdc873c}",
      "Problem": "8",
      "DetectedBy": "2",
      "ActiveOperation": "0",
      "ExitCode": "1879048193",
      "Message": "0",
      "Status": "4294967295"
    }
  },
  "message": "A problem has occurred with one or more user-mode drivers and the hosting process has been terminated.  This may temporarily interrupt your ability to access the devices."
}

Event ID 10111: The device FriendlyName (location Location) is offline due to a user-mode driver crash.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System
Level: Critical
Task: User_modeDriverproblems.

Description

The device UmdfDeviceOffline.FriendlyName (location UmdfDeviceOffline.Location) is offline due to a user-mode driver crash. Windows will attempt to restart the device UmdfDeviceOffline.RestartCount more times. Please contact the device manufacturer for more information about this problem.

Message #

The device %2 (location %3) is offline due to a user-mode driver crash.  Windows will attempt to restart the device %5 more times.  Please contact the device manufacturer for more information about this problem.

Fields #

Name	Description
`UmdfDeviceOffline.LifetimeId` GUID
`UmdfDeviceOffline.FriendlyName` UnicodeString
`UmdfDeviceOffline.Location` UnicodeString
`UmdfDeviceOffline.InstanceId` UnicodeString
`UmdfDeviceOffline.RestartCount` UInt32
`LifetimeId` GUID
`FriendlyName` UnicodeString
`Location` UnicodeString
`InstanceId` UnicodeString
`RestartCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "{2E35AAEB-857F-4BEB-A418-2E6C0E54D988}",
    "event_source_name": "",
    "event_id": 10111,
    "version": 1,
    "level": 1,
    "task": 64,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2026-04-15T21:23:59.3775735+00:00",
    "event_record_id": 5291,
    "correlation": {},
    "execution": {
      "process_id": 1040,
      "thread_id": 1184
    },
    "channel": "System",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "UmdfDeviceOffline": {
      "LifetimeId": "{d2ed148d-92b3-4630-b3ae-32cd0fdc873c}",
      "FriendlyName": "Microsoft Remote Display Adapter",
      "Location": "(unknown)",
      "InstanceId": "SWD\\REMOTEDISPLAYENUM\\RDPIDD_INDIRECTDISPLAY&SESSIONID_0001",
      "RestartCount": "5"
    }
  },
  "message": "The device Microsoft Remote Display Adapter (location (unknown)) is offline due to a user-mode driver crash.  Windows will attempt to restart the device 5 more times.  Please contact the device manufacturer for more information about this problem."
}

Event ID 10112: The device FriendlyName (location Location) is offline due to a user-mode device crash.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System
Task: User_modeDriverproblems.

Description

The device FriendlyName (location Location) is offline due to a user-mode device crash. Windows will no longer attempt to restart this device because the maximum restart limit has been reached. Disconnecting the device and reconnecting it, or disabling it and re-enabling it from the device manager, will reset this limit and allow the device to be accessed again. Please contact the device manufacturer for more information about this problem.

Message #

The device %2 (location %3) is offline due to a user-mode device crash.  Windows will no longer attempt to restart this device because the maximum restart limit has been reached.  Disconnecting the device and reconnecting it, or disabling it and re-enabling it from the device manager, will reset this limit and allow the device to be accessed again.  Please contact the device manufacturer for more information about this problem.

Fields #

Name	Description
`LifetimeId` GUID
`FriendlyName` UnicodeString
`Location` UnicodeString
`InstanceId` UnicodeString
`RestartCount` UInt32

Event ID 10113: The device InstanceId was unable to start due to conflict between the settings for driver DriverName (ConflictingParameter - Value) and the other drivers.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System
Task: Startupofanewdriverhostprocess.

Description

The device InstanceId was unable to start due to conflict between the settings for driver DriverName (ConflictingParameter - Value) and the other drivers. Windows will not be able to start this device. Please contact the device manufacturer for assistance.

Message #

The device %2 was unable to start due to conflict between the settings for driver %5 (%3 - %4) and the other drivers.  Windows will not be able to start this device.  Please contact the device manufacturer for assistance.

Fields #

Name	Description
`LifetimeId` GUID
`InstanceId` UnicodeString
`ConflictingParameter` UnicodeString
`Value` UInt64
`DriverName` UnicodeString

Event ID 10114: {UnstartedService} (part of UMDF) did not load yet.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System

Description

{UnstartedService} (part of UMDF) did not load yet. After it does; Windows will start the device again.

Message #

{UnstartedService} (part of UMDF) did not load yet. After it does; Windows will start the device again.

Fields #

Name	Description
`UnstartedService`

Event ID 10115: The device FriendlyName (location Location) is offline due to a user-mode driver crash.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System
Task: User_modeDriverproblems.

Description

The device FriendlyName (location Location) is offline due to a user-mode driver crash. Windows will attempt to restart the device RestartCount more times in its own process. Please contact the device manufacturer for more information about this problem.

Message #

The device %2 (location %3) is offline due to a user-mode driver crash.  Windows will attempt to restart the device %5 more times in its own process.  Please contact the device manufacturer for more information about this problem.

Fields #

Name	Description
`LifetimeId` GUID
`FriendlyName` UnicodeString
`Location` UnicodeString
`InstanceId` UnicodeString
`RestartCount` UInt32

Event ID 10116: The device FriendlyName (location Location) is offline due to a user-mode driver crash.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System
Task: User_modeDriverproblems.

Description

The device FriendlyName (location Location) is offline due to a user-mode driver crash. Windows will attempt to restart the device in the shared process RestartCount more times before moving the device in its own process. Please contact the device manufacturer for more information about this problem.

Message #

The device %2 (location %3) is offline due to a user-mode driver crash.  Windows will attempt to restart the device in the shared process %5 more times before moving the device in its own process.  Please contact the device manufacturer for more information about this problem.

Fields #

Name	Description
`LifetimeId` GUID
`FriendlyName` UnicodeString
`Location` UnicodeString
`InstanceId` UnicodeString
`RestartCount` UInt32

Event ID 10117: UMDF driver service ServiceName failed to load because it was compiled using a pre-release version of the Windows Driver Kit(WDK).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System
Task: Installationorupdateofdevicedrivers.

Description

UMDF driver service ServiceName failed to load because it was compiled using a pre-release version of the Windows Driver Kit(WDK). The driver should be recompiled using a release version of the WDK. Driver's function table count is ActualFuntionTableCount and the expected count is ExpectedFuntionTableCount.

Message #

UMDF driver service %1 failed to load because it was compiled using a pre-release version of the Windows Driver Kit(WDK). The driver should be recompiled using a release version of the WDK. Driver's function table count is %2 and the expected count is %3.

Fields #

Name	Description
`ServiceName` UnicodeString
`ActualFuntionTableCount` UInt32
`ExpectedFuntionTableCount` UInt32

Event ID 10118: UMDF reflector is unable to connect to service control manager (SCM).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System
Task: StartupoftheUMDFreflector

Description

UMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.

Message #

UMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.

Event ID 10120: A problem has occurred with one or more user-mode drivers and the hosting process has been terminated.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System
Task: User_modeDriverproblems.

Description

A problem has occurred with one or more user-mode drivers and the hosting process has been terminated. This may temporarily interrupt your ability to access the devices.

Message #

A problem has occurred with one or more user-mode drivers and the hosting process has been terminated.  This may temporarily interrupt your ability to access the devices.

Fields #

Name	Description
`LifetimeId` GUID
`Problem` UInt8
`DetectedBy` UInt8
`ActiveOperation` UInt8
`ExitCode` UInt32
`Message` UInt32
`Status` UInt32	NTSTATUS reference
`InstanceId` UnicodeString
`HardwareId` UnicodeString
`ServiceName` UnicodeString

Event ID 10121: A runtime failure has occurred in user-mode driver Driver and the hosting process has been terminated.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System
Task: User_modeDriverproblems.

Description

Message #

A runtime failure has occurred in user-mode driver %5 and the hosting process has been terminated. This may temporarily interrupt your ability to access the devices. Please contact the device manufacturer or driver vendor for more information about this problem.

Fields #

Name	Description
`LifetimeId` GUID
`Category` UnicodeString
`ErrorNumber` HexInt64
`Location` UnicodeString
`Driver` UnicodeString
`ImageVersion` UnicodeString
`UMDFVersion` UnicodeString

Event ID 19999: UMDF Test Event (String).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: System
Task: TestingUMDF

Description

UMDF Test Event (String).

Message #

UMDF Test Event (%1)

Fields #

Name	Description
`String` UnicodeString

Event ID 20030: Power IRP related event in the User-mode Driver Frameworks Host Process

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Diagnostic
Task: PowerTransition_Driver
Opcode: Start

Description

Power IRP related event in the User-mode Driver Frameworks Host Process.

Message #

Power IRP related event in the User-mode Driver Frameworks Host Process

Fields #

Name	Description
`Irp` Pointer
`Device` Pointer
`DriverName` UnicodeString

Event ID 20031: Power IRP related event in the User-mode Driver Frameworks Host Process

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Diagnostic
Task: PowerTransition_Driver
Opcode: Stop

Description

Power IRP related event in the User-mode Driver Frameworks Host Process.

Message #

Power IRP related event in the User-mode Driver Frameworks Host Process

Fields #

Name	Description
`Irp` Pointer
`Device` Pointer

Event ID 20032: Power IRP related event in the User-mode Driver Frameworks Host Process

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Diagnostic
Task: PowerTransition_Driver
Opcode: NestingStart

Description

Power IRP related event in the User-mode Driver Frameworks Host Process.

Message #

Power IRP related event in the User-mode Driver Frameworks Host Process

Fields #

Name	Description
`Irp` Pointer
`Device` Pointer

Event ID 20033: Power IRP related event in the User-mode Driver Frameworks Host Process

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Diagnostic
Task: PowerTransition_Driver
Opcode: NestingStop

Description

Power IRP related event in the User-mode Driver Frameworks Host Process.

Message #

Power IRP related event in the User-mode Driver Frameworks Host Process

Fields #

Name	Description
`Irp` Pointer
`Device` Pointer

Event ID 30000: A driver package which uses user-mode driver framework version {FrameworkVersion} is being installed on device {DeviceId}.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational

Description

A driver package which uses user-mode driver framework version {FrameworkVersion} is being installed on device {DeviceId}.

Message #

A driver package which uses user-mode driver framework version {FrameworkVersion} is being installed on device {DeviceId}.

Fields #

Name	Description
`FrameworkVersion`
`DeviceId`

Event ID 30001: The driver package installation has finished.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational

Description

The driver package installation has finished. The final status was {FinalStatus}.

Message #

The driver package installation has finished. The final status was {FinalStatus}.

Fields #

Name	Description
`FinalStatus`

Event ID 30002: PreDevice installation (UMDF version {FrameworkVersion}) is starting for device {DeviceId}.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational

Description

PreDevice installation (UMDF version {FrameworkVersion}) is starting for device {DeviceId}.

Message #

PreDevice installation (UMDF version {FrameworkVersion}) is starting for device {DeviceId}.

Fields #

Name	Description
`FrameworkVersion`
`DeviceId`

Event ID 30003: PreDevice installation has finished.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational

Description

PreDevice installation has finished. The final status was {FinalStatus}.

Message #

PreDevice installation has finished. The final status was {FinalStatus}.

Fields #

Name	Description
`FinalStatus`

Event ID 30004: PostDevice installation (UMDF version {FrameworkVersion}) is starting for device {DeviceId}.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational

Description

PostDevice installation (UMDF version {FrameworkVersion}) is starting for device {DeviceId}.

Message #

PostDevice installation (UMDF version {FrameworkVersion}) is starting for device {DeviceId}.

Fields #

Name	Description
`FrameworkVersion`
`DeviceId`

Event ID 30005: PostDevice installation has finished.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational

Description

PostDevice installation has finished. The final status was {FinalStatus}.

Message #

PostDevice installation has finished. The final status was {FinalStatus}.

Fields #

Name	Description
`FinalStatus`

Event ID 30007: UMDF has been updated.

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational

Description

UMDF has been updated. The final status was {FinalStatus}.

Message #

UMDF has been updated. The final status was {FinalStatus}.

Fields #

Name	Description
`FinalStatus`

Event ID 30008: DDI to read from hardware begins (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: DDIcalltoreadfromHardware.
Opcode: Start

Description

DDI to read from hardware begins (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Message #

DDI to read from hardware begins (TargetType: %1, TargetSize: %2, BufferCount: %3).

Fields #

Name	Description
`HwAccessTargetType` UInt32
`HwAccessTargetSize` UInt32
`HwAccessBufferCount` UInt32

Event ID 30009: DDI to read from hardware ends (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: DDIcalltoreadfromHardware.
Opcode: Stop

Description

DDI to read from hardware ends (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Message #

DDI to read from hardware ends (TargetType: %1, TargetSize: %2, BufferCount: %3).

Fields #

Name	Description
`HwAccessTargetType` UInt32
`HwAccessTargetSize` UInt32
`HwAccessBufferCount` UInt32

Event ID 30010: Read from hardware begins (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: ReadfromHardware.
Opcode: Start

Description

Read from hardware begins (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Message #

Read from hardware begins (TargetType: %1, TargetSize: %2, BufferCount: %3).

Fields #

Name	Description
`HwAccessTargetType` UInt32
`HwAccessTargetSize` UInt32
`HwAccessBufferCount` UInt32

Event ID 30011: Read from hardware ends (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: ReadfromHardware.
Opcode: Stop

Description

Read from hardware ends (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Message #

Read from hardware ends (TargetType: %1, TargetSize: %2, BufferCount: %3).

Fields #

Name	Description
`HwAccessTargetType` UInt32
`HwAccessTargetSize` UInt32
`HwAccessBufferCount` UInt32

Event ID 30012: DDI to write to hardware begins (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: DDIcalltoWritetohardware.
Opcode: Start

Description

DDI to write to hardware begins (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Message #

DDI to write to hardware begins (TargetType: %1, TargetSize: %2, BufferCount: %3).

Fields #

Name	Description
`HwAccessTargetType` UInt32
`HwAccessTargetSize` UInt32
`HwAccessBufferCount` UInt32

Event ID 30013: DDI to write to hardware ends (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: DDIcalltoWritetohardware.
Opcode: Stop

Description

DDI to write to hardware ends (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Message #

DDI to write to hardware ends (TargetType: %1, TargetSize: %2, BufferCount: %3).

Fields #

Name	Description
`HwAccessTargetType` UInt32
`HwAccessTargetSize` UInt32
`HwAccessBufferCount` UInt32

Event ID 30014: Write to hardware begins (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: Writetohardware.
Opcode: Start

Description

Write to hardware begins (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Message #

Write to hardware begins (TargetType: %1, TargetSize: %2, BufferCount: %3).

Fields #

Name	Description
`HwAccessTargetType` UInt32
`HwAccessTargetSize` UInt32
`HwAccessBufferCount` UInt32

Event ID 30015: Write to hardware ends (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: Writetohardware.
Opcode: Stop

Description

Write to hardware ends (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Message #

Write to hardware ends (TargetType: %1, TargetSize: %2, BufferCount: %3).

Fields #

Name	Description
`HwAccessTargetType` UInt32
`HwAccessTargetSize` UInt32
`HwAccessBufferCount` UInt32

Event ID 30016: Read from hardware begins (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: ReadfromHardware.
Opcode: Start

Description

Read from hardware begins (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Message #

Read from hardware begins (TargetType: %1, TargetSize: %2, BufferCount: %3).

Fields #

Name	Description
`HwAccessTargetType` UInt32
`HwAccessTargetSize` UInt32
`HwAccessBufferCount` UInt32

Event ID 30017: Read from hardware ends (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: ReadfromHardware.
Opcode: Stop

Description

Read from hardware ends (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Message #

Read from hardware ends (TargetType: %1, TargetSize: %2, BufferCount: %3).

Fields #

Name	Description
`HwAccessTargetType` UInt32
`HwAccessTargetSize` UInt32
`HwAccessBufferCount` UInt32

Event ID 30018: Write to hardware begins (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: Writetohardware.
Opcode: Start

Description

Write to hardware begins (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Message #

Write to hardware begins (TargetType: %1, TargetSize: %2, BufferCount: %3).

Fields #

Name	Description
`HwAccessTargetType` UInt32
`HwAccessTargetSize` UInt32
`HwAccessBufferCount` UInt32

Event ID 30019: Write to hardware ends (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: Writetohardware.
Opcode: Stop

Description

Write to hardware ends (TargetType: HwAccessTargetType, TargetSize: HwAccessTargetSize, BufferCount: HwAccessBufferCount).

Message #

Write to hardware ends (TargetType: %1, TargetSize: %2, BufferCount: %3).

Fields #

Name	Description
`HwAccessTargetType` UInt32
`HwAccessTargetSize` UInt32
`HwAccessBufferCount` UInt32

Event ID 30020: UMDF Reflector sent notification for hardware interrupt (Message ID InterruptMessageNumber).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: UMDFhardwareinterruptnotification.

Description

UMDF Reflector sent notification for hardware interrupt (Message ID InterruptMessageNumber).

Message #

UMDF Reflector sent notification for hardware interrupt (Message ID %1).

Fields #

Name	Description
`InterruptMessageNumber` UInt32

Event ID 30021: UMDF framework received notification for hardware interrupt (Message ID InterruptMessageNumber).

Provider: Microsoft-Windows-DriverFrameworks-UserMode
Channel: Operational
Task: UMDFhardwareinterruptnotification.

Description

UMDF framework received notification for hardware interrupt (Message ID InterruptMessageNumber).

Message #

UMDF framework received notification for hardware interrupt (Message ID %1).

Fields #

Name	Description
`InterruptMessageNumber` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 2e35aaeb-857f-4beb-a418-2e6c0e54d988

Defined in WUDFPlatform.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)