Microsoft-Windows-WPD-MTPBT
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 100 | Write MTP BT Packet to data channel | Analytic | N | N |
| 101 | Write MTP BT Packet to event channel | Analytic | N | N |
| 102 | Read MTP BT Packet from data channel | Analytic | N | N |
| 103 | Read MTP BT Packet from event channel | Analytic | N | N |
| 104 | Read MTP BT Data Packet | Analytic | N | N |
| 105 | Received BT Device Event | Analytic | N | N |
| 106 | Received BT Unexpected header on data channel | Analytic | N | N |
| 107 | Received BT Unexpected header on event channel | Analytic | N | N |
Event ID 100: Write MTP BT Packet to data channel
#Fields #
| Name | Description |
|---|---|
MTPBTPacketLength UInt32 | |
MTPBTPacketData Binary |
Event ID 101: Write MTP BT Packet to event channel
#Fields #
| Name | Description |
|---|---|
MTPBTPacketLength UInt32 | |
MTPBTPacketData Binary |
Event ID 102: Read MTP BT Packet from data channel
#Fields #
| Name | Description |
|---|---|
MTPBTPacketLength UInt32 | |
MTPBTPacketData Binary |
Event ID 103: Read MTP BT Packet from event channel
#Fields #
| Name | Description |
|---|---|
MTPBTPacketLength UInt32 | |
MTPBTPacketData Binary |
Event ID 104: Read MTP BT Data Packet
#Fields #
| Name | Description |
|---|---|
MTPBTPacketLength UInt32 | |
MTPBTPacketType UInt16 | |
MTPBTPacketSeqID UInt16 |
Event ID 105: Received BT Device Event
#Fields #
| Name | Description |
|---|---|
MTPBTEventLength UInt32 | |
MTPBTEventData Binary |
Provenance
ETW provider GUID 92ab58d3-f351-4af5-9c72-d52f36ee2c92
Defined in wpd_ci.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB