Microsoft-Windows-SmbHashGeneration
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1000 | Service initialization failed with error {ResultCode}. | Operational | N | N |
| 1001 | Hash generation for file {Path} failed with error {ResultCode}. | Operational | N | N |
| 1002 | Hash deletion for file {Path} failed with error {ResultCode}. | Operational | N | N |
| 1003 | The hash for the file with object ID {Hash} on volume {Volume} could not be … | Operational | N | N |
| 2000 | The SMB server has requested hash generation for file {Path}. | Analytic | N | N |
| 2001 | The SMB server has retrieved the hash for file {Path}. | Analytic | N | N |
| 2002 | Hash generated for file {Path}. | Analytic | N | N |
| 2003 | Hash deleted for file {Path}. | Analytic | N | N |
| 2004 | The hash for the file with object ID {Hash} on volume {Volume} was deleted to … | Analytic | N | N |
Event ID 1000: Service initialization failed with error {ResultCode}.
#Event ID 1001: Hash generation for file {Path} failed with error {ResultCode}.
#Event ID 1002: Hash deletion for file {Path} failed with error {ResultCode}.
#Event ID 1003: The hash for the file with object ID {Hash} on volume {Volume} could not be deleted to free volume space due to error {ResultCode}.
#Event ID 2000: The SMB server has requested hash generation for file {Path}.
#Fields #
| Name | Description |
|---|---|
Path |