detection.wiki

Microsoft-Windows-WMS-VolFilter

EventTitleChannelSampleRule
1NT_STATUS NT_STATUS returned in function FunctionName.OperationalNN
2Event ID 2OperationalNN
3Function Message succeeded.OperationalNN

Event ID 1: NT_STATUS NT_STATUS returned in function FunctionName.

#
Channel
Operational

Message #

NT_STATUS %1 returned in function %2

Fields #

NameDescription
NT_STATUS UInt32
FunctionName UnicodeString

Event ID 2

#
Channel
Operational

Message #

%1

Fields #

NameDescription
Message UnicodeString

Event ID 3: Function Message succeeded.

#
Channel
Operational

Message #

Function %1 succeeded

Fields #

NameDescription
Message UnicodeString