detection.wiki

Microsoft-Windows-Wmbclass-Opn

EventTitleChannelSampleRule
1Sending command MessageType: MessageType, MessageLength: MessageLength, …OperationalNN
2Receiving command done MessageType: MessageType, MessageLength: MessageLength, …OperationalNN
3Receiving indication MessageType: MessageType, MessageLength: MessageLength, …OperationalNN
4Receiving MessageType: MessageType, MessageLength: MessageLength, …OperationalNN
5Receiving MessageType: MessageType, MessageLength: MessageLength, …OperationalNN

Event ID 1: Sending command MessageType: MessageType, MessageLength: MessageLength, MessageTransactionId: MessageTransactionId, TotalFragments: TotalFragments, CurrentFragment: CurrentFragment, ServiceId: Serv...

#
Channel
Operational
Opcode
Info

Description

Sending command MessageType: , MessageLength: , MessageTransactionId: , TotalFragments: , CurrentFragment: , ServiceId: , CommandId: , CommandType: , InformationBufferLength: , InformationBuffer.

Message #

Sending command MessageType: %1, MessageLength: %2, MessageTransactionId: %3, TotalFragments: %4, CurrentFragment: %5, ServiceId: %6, CommandId: %7, CommandType: %8, InformationBufferLength: %9, InformationBuffer: %10

Fields #

NameDescription
MessageType UInt32
MessageLength UInt32
MessageTransactionId UInt32
TotalFragments UInt32
CurrentFragment UInt32
ServiceId GUID
CommandId UInt32
CommandType UInt32
InformationBufferLength UInt32
InformationBuffer Binary

Event ID 2: Receiving command done MessageType: MessageType, MessageLength: MessageLength, MessageTransactionId: MessageTransactionId, TotalFragments: TotalFragments, CurrentFragment: CurrentFragment, ServiceI...

#
Channel
Operational
Opcode
Info

Description

Receiving command done MessageType: , MessageLength: , MessageTransactionId: , TotalFragments: , CurrentFragment: , ServiceId: , CommandId: , Status: , InformationBufferLength: , InformationBuffer.

Message #

Receiving command done MessageType: %1, MessageLength: %2, MessageTransactionId: %3, TotalFragments: %4, CurrentFragment: %5, ServiceId: %6, CommandId: %7, Status: %8, InformationBufferLength: %9, InformationBuffer: %10

Fields #

NameDescription
MessageType UInt32
MessageLength UInt32
MessageTransactionId UInt32
TotalFragments UInt32
CurrentFragment UInt32
ServiceId GUID
CommandId UInt32
Status UInt32NTSTATUS reference
InformationBufferLength UInt32
InformationBuffer Binary

Event ID 3: Receiving indication MessageType: MessageType, MessageLength: MessageLength, MessageTransactionId: MessageTransactionId, TotalFragments: TotalFragments, CurrentFragment: CurrentFragment, ServiceId:...

#
Channel
Operational
Opcode
Info

Description

Receiving indication MessageType: , MessageLength: , MessageTransactionId: , TotalFragments: , CurrentFragment: , ServiceId: , CommandId: , InformationBufferLength: , InformationBuffer.

Message #

Receiving indication MessageType: %1, MessageLength: %2, MessageTransactionId: %3, TotalFragments: %4, CurrentFragment: %5, ServiceId: %6, CommandId: %7, InformationBufferLength: %8, InformationBuffer: %9

Fields #

NameDescription
MessageType UInt32
MessageLength UInt32
MessageTransactionId UInt32
TotalFragments UInt32
CurrentFragment UInt32
ServiceId GUID
CommandId UInt32
InformationBufferLength UInt32
InformationBuffer Binary

Event ID 4: Receiving MessageType: MessageType, MessageLength: MessageLength, MessageTransactionId: MessageTransactionId, Uint32 payload: Status.

#
Channel
Operational
Opcode
Info

Message #

Receiving MessageType: %1, MessageLength: %2, MessageTransactionId: %3, Uint32 payload: %4

Fields #

NameDescription
MessageType UInt32
MessageLength UInt32
MessageTransactionId UInt32
Status UInt32NTSTATUS reference

Event ID 5: Receiving MessageType: MessageType, MessageLength: MessageLength, MessageTransactionId: MessageTransactionId.

#
Channel
Operational
Opcode
Info

Message #

Receiving MessageType: %1, MessageLength: %2, MessageTransactionId: %3

Fields #

NameDescription
MessageType UInt32
MessageLength UInt32
MessageTransactionId UInt32

Provenance

ETW provider GUID a42fe227-a7bf-4483-a502-6bcda428cd96

Defined in mbbcx.sys, the binary that emits these events.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.6584, captured 2026-06-02 — Manifest XML pack, 2.0 MB