detection.wiki

Microsoft-Windows-KernelStreaming

EventTitleChannelSampleRule
200KS_PnpAddDevice StartOperational, WINDOWS_KS_CHANNELNN
201KS_PnpAddDevice StopOperational, WINDOWS_KS_CHANNELNN
202KS_StreamingRequest Start, pIrp: pIrpAnalytic, WINDOWS_KS_CHANNELNN
203KS_StreamingRequest Stop, pIrp: pIrpAnalytic, WINDOWS_KS_CHANNELNN
204KS_CameraGrab Start, ProcessId: ProcessId, PinId: PinId, FilterAddress: …Operational, WINDOWS_KS_CHANNELNN
205KS_CameraGrab Stop, Status: StatusOperational, WINDOWS_KS_CHANNELNN
206KS_WNF RegisterOperational, WINDOWS_KS_CHANNELNN
207KS_WNF UnregisterOperational, WINDOWS_KS_CHANNELNN
208KS_WNFPinState Update, FilterExt: FilterExt, PinState: PinStateOperational, WINDOWS_KS_CHANNELNN
209KS_WNFNotification Fire, EntryCount: EntryCountOperational, WINDOWS_KS_CHANNELNN
210KS_DisplayOff StopStreamsOperational, WINDOWS_KS_CHANNELNN
211KS_IoProbeandLock Start, PinId: PinId, BufSize: BufSizeAnalytic, WINDOWS_KS_CHANNELNN
212KS_IoProbeandLock End, PinId: PinId, BufSize: BufSizeAnalytic, WINDOWS_KS_CHANNELNN
213KS_QueryInterface Start, pKsDevice: pKsDevice, pIrp: pIrp, InterfaceGuid: …Operational, WINDOWS_KS_CHANNELNN
214KS_QueryInterface Stop, pKsDevice: pKsDevice, pIrp: pIrp, InterfaceGuid: …Operational, WINDOWS_KS_CHANNELNN

Event ID 200: KS_PnpAddDevice Start

#
Channel
Operational, WINDOWS_KS_CHANNEL
Task
KS_PnpAddDevice
Opcode
Start

Event ID 201: KS_PnpAddDevice Stop

#
Channel
Operational, WINDOWS_KS_CHANNEL
Task
KS_PnpAddDevice
Opcode
Stop

Event ID 202: KS_StreamingRequest Start, pIrp: pIrp

#
Channel
Analytic, WINDOWS_KS_CHANNEL
Task
KS_StreamingRequest
Opcode
Start

Message #

KS_StreamingRequest Start, pIrp: %1.

Fields #

NameDescription
pIrp Pointer

Event ID 203: KS_StreamingRequest Stop, pIrp: pIrp

#
Channel
Analytic, WINDOWS_KS_CHANNEL
Task
KS_StreamingRequest
Opcode
Stop

Message #

KS_StreamingRequest Stop, pIrp: %1.

Fields #

NameDescription
pIrp Pointer

Event ID 204: KS_CameraGrab Start, ProcessId: ProcessId, PinId: PinId, FilterAddress: FilterAddress

#
Channel
Operational, WINDOWS_KS_CHANNEL
Task
KS_CameraGrab
Opcode
Start

Message #

KS_CameraGrab Start, ProcessId: %1, PinId: %2, FilterAddress: %3.

Fields #

NameDescription
ProcessId Pointer
PinId UInt32
FilterAddress Pointer

Event ID 205: KS_CameraGrab Stop, Status: Status

#
Channel
Operational, WINDOWS_KS_CHANNEL
Task
KS_CameraGrab
Opcode
Stop

Message #

KS_CameraGrab Stop, Status: %1.

Fields #

NameDescription
Status HexInt32NTSTATUS reference

Event ID 206: KS_WNF Register

#
Channel
Operational, WINDOWS_KS_CHANNEL
Task
KS_WNF

Event ID 207: KS_WNF Unregister

#
Channel
Operational, WINDOWS_KS_CHANNEL
Task
KS_WNF

Event ID 208: KS_WNFPinState Update, FilterExt: FilterExt, PinState: PinState

#
Channel
Operational, WINDOWS_KS_CHANNEL
Task
KS_WNFPinState

Message #

KS_WNFPinState Update, FilterExt: %1, PinState: %2.

Fields #

NameDescription
FilterExt Pointer
PinState UInt32

Event ID 209: KS_WNFNotification Fire, EntryCount: EntryCount

#
Channel
Operational, WINDOWS_KS_CHANNEL
Task
KS_WNFNotification

Message #

KS_WNFNotification Fire, EntryCount: %1.

Fields #

NameDescription
EntryCount UInt32

Event ID 210: KS_DisplayOff StopStreams

#
Channel
Operational, WINDOWS_KS_CHANNEL
Task
KS_DisplayOff

Event ID 211: KS_IoProbeandLock Start, PinId: PinId, BufSize: BufSize

#
Channel
Analytic, WINDOWS_KS_CHANNEL
Task
KS_IoProbeandLock
Opcode
Start

Message #

KS_IoProbeandLock Start, PinId: %1, BufSize: %2.

Fields #

NameDescription
PinId HexInt32
BufSize UInt32

Event ID 212: KS_IoProbeandLock End, PinId: PinId, BufSize: BufSize

#
Channel
Analytic, WINDOWS_KS_CHANNEL
Task
KS_IoProbeandLock
Opcode
Stop

Message #

KS_IoProbeandLock End, PinId: %1, BufSize: %2.

Fields #

NameDescription
PinId HexInt32
BufSize UInt32

Event ID 213: KS_QueryInterface Start, pKsDevice: pKsDevice, pIrp: pIrp, InterfaceGuid: InterfaceGuid, Status: Status

#
Channel
Operational, WINDOWS_KS_CHANNEL
Task
KS_QueryInterface
Opcode
Start

Message #

KS_QueryInterface Start, pKsDevice: %1, pIrp: %2, InterfaceGuid: %3, Status: %4.

Fields #

NameDescription
pKsDevice Pointer
pIrp Pointer
InterfaceGuid GUID
Status UInt32NTSTATUS reference

Event ID 214: KS_QueryInterface Stop, pKsDevice: pKsDevice, pIrp: pIrp, InterfaceGuid: InterfaceGuid, Status: Status

#
Channel
Operational, WINDOWS_KS_CHANNEL
Task
KS_QueryInterface
Opcode
Stop

Message #

KS_QueryInterface Stop, pKsDevice: %1, pIrp: %2, InterfaceGuid: %3, Status: %4.

Fields #

NameDescription
pKsDevice Pointer
pIrp Pointer
InterfaceGuid GUID
Status UInt32NTSTATUS reference

Provenance

ETW provider GUID 548c4417-ce45-41ff-99dd-528f01ce0fe1

Defined in ks.sys, the binary that emits these events.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4767, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.6584, captured 2026-06-02 — Manifest XML pack, 2.0 MB