detection.wiki

Microsoft-Windows-Usbstor

EventTitleChannelSampleRule
100Request servicing time taken by USBSTOR driver stack.AnalyticNN

Event ID 100: Request servicing time taken by USBSTOR driver stack.

#
Channel
Analytic
Task
Io

Fields #

NameDescription
Port UInt8
Bus UInt8
Target UInt8
LUN UInt8
RequestDuration UInt64
CDBLength UInt32
CDB Binary
SrbStatus UInt8
Irp Pointer
OriginalIrp Pointer

Provenance

ETW provider GUID 77e27ce0-f816-4c53-b601-2c042a883a78

Defined in usbstor.sys, the binary that emits these events.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB