Microsoft-Windows-Serial-ClassExtension

Event	Title	Channel	Sample	Rule
1000	The Serial WDF class extension has started.	Analytic	N	N
1001	The Serial WDF class extension failed to start (error Status).	Analytic	N	N
1002	Received request Request for IoControlCodeString.	Analytic	N	N
1003	Request Complete.	Analytic	N	N
1004	Transmitting request Request for Length byte(s).	Analytic	N	N
1005	Receiving request Request for Length byte(s).	Analytic	N	N
1006	Completed request Request for Length byte(s) with status Status.	Analytic	N	N
1007	Data.	Analytic	N	N
1008	EvtIoStop for request Request in queue Queue, invoke cancel.	Analytic	N	N

Event ID 1000: The Serial WDF class extension has started.

Channel: Analytic
Task: Startupoftheserialclassextension

Description

The Serial WDF class extension has started. The control object name is ControlDeviceName.

Message #

The Serial WDF class extension has started.  The control object name is %1.

Fields #

Name	Description
`ControlDeviceName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 1001: The Serial WDF class extension failed to start (error Status).

Channel: Analytic
Task: Startupoftheserialclassextension

Description

The Serial WDF class extension failed to start (error Status). The control object name is ControlDeviceName.

Message #

The Serial WDF class extension failed to start (error %2).  The control object name is %1.

Fields #

Name	Description
`ControlDeviceName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 1002: Received request Request for IoControlCodeString.

Channel: Analytic
Task: IOControlreceivedbytheserialclassextension
Opcode: Start

Message #

Received request %1 for %2

Fields #

Name	Description
`Request` Pointer
`IoControlCodeString` UnicodeString

Event ID 1003: Request Complete.

Channel: Analytic
Task: IOControlreceivedbytheserialclassextension
Opcode: Stop

Message #

%1 Complete

Fields #

Name	Description
`Request` Pointer
`IoControlCodeString` UnicodeString

Event ID 1004: Transmitting request Request for Length byte(s).

Channel: Analytic
Task: Requestreceivedbytheserialclassextension
Opcode: Start

Message #

Transmitting request %1 for %2 byte(s)

Fields #

Name	Description
`Request` Pointer
`Length` UInt32

Event ID 1005: Receiving request Request for Length byte(s).

Channel: Analytic
Task: Requestreceivedbytheserialclassextension
Opcode: Start

Message #

Receiving request %1 for %2 byte(s)

Fields #

Name	Description
`Request` Pointer
`Length` UInt32

Event ID 1006: Completed request Request for Length byte(s) with status Status.

Channel: Analytic
Task: Requestreceivedbytheserialclassextension
Opcode: Stop

Message #

Completed request %1 for %2 byte(s) with status %3

Fields #

Name	Description
`Request` Pointer
`Length` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 1007: Data.

Channel: Analytic
Task: Requestreceivedbytheserialclassextension

Message #

%1

Fields #

Name	Description
`Data` UInt8

Event ID 1008: EvtIoStop for request Request in queue Queue, invoke cancel.

Channel: Analytic
Task: Requestreceivedbytheserialclassextension

Message #

EvtIoStop for request %1 in queue %2, invoke cancel

Fields #

Name	Description
`Request` Pointer
`Queue` Pointer

Provenance

ETW provider GUID 47bc9477-a8ba-452e-b951-4f2ed3593cf9

Defined in SerCx.sys, the binary that emits these events.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1150, captured 2026-06-02 — Manifest XML pack, 2.0 MB