detection.wiki

Microsoft-Windows-ServicesForNFS-ONCRPC

EventTitleChannelSampleRule
8000Winsock indication.AnalyticNN
8000Event ID 8000OperationalNN
8001Packet received.AnalyticNN
8001Event ID 8001OperationalNN
8002NFS server indicated.AnalyticNN
8002Event ID 8002OperationalNN
8003Workitem queued.AnalyticNN
8003Event ID 8003OperationalNN
8004Send reply.AnalyticNN
8004Event ID 8004OperationalNN
8005Reply received.AnalyticNN
8005Event ID 8005OperationalNN
8006Workitem completed.AnalyticNN
8006Event ID 8006OperationalNN

Event ID 8000: Winsock indication.

#
Channel
Analytic
Task
ReceivePacket

Fields #

NameDescription
RequestId UInt32

Event ID 8000

#
Channel
Operational
Task
ReceivePacket

Description

Winsock indication.

Fields #

NameDescription
RequestId UInt32

Event ID 8001: Packet received.

#
Channel
Analytic
Task
ReceivePacket

Fields #

NameDescription
RequestId UInt32

Event ID 8001

#
Channel
Operational
Task
ReceivePacket

Description

Packet received.

Fields #

NameDescription
RequestId UInt32

Event ID 8002: NFS server indicated.

#
Channel
Analytic
Task
IndicateServer

Fields #

NameDescription
RequestId UInt32

Event ID 8002

#
Channel
Operational
Task
IndicateServer

Description

NFS server indicated.

Fields #

NameDescription
RequestId UInt32

Event ID 8003: Workitem queued.

#
Channel
Analytic
Task
EnQueueWorkitem

Fields #

NameDescription
RequestId UInt32

Event ID 8003

#
Channel
Operational
Task
EnQueueWorkitem

Description

Workitem queued.

Fields #

NameDescription
RequestId UInt32

Event ID 8004: Send reply.

#
Channel
Analytic
Task
SendPacket

Fields #

NameDescription
RequestId UInt32

Event ID 8004

#
Channel
Operational
Task
SendPacket

Description

Send reply.

Fields #

NameDescription
RequestId UInt32

Event ID 8005: Reply received.

#
Channel
Analytic
Task
SendPacket

Fields #

NameDescription
RequestId UInt32

Event ID 8005

#
Channel
Operational
Task
SendPacket

Description

Reply received.

Fields #

NameDescription
RequestId UInt32

Event ID 8006: Workitem completed.

#
Channel
Analytic
Task
SendPacket

Fields #

NameDescription
RequestId UInt32

Event ID 8006

#
Channel
Operational
Task
SendPacket

Description

Workitem completed.

Fields #

NameDescription
RequestId UInt32