Microsoft-Windows-WPD-MTPUS
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 100 | Write MTP USB SendCommand | Analytic | N | N |
| 101 | Write MTP USB Response | Analytic | N | N |
| 102 | Received MTP USB Device Event | Analytic | N | N |
| 103 | Read MTP USB Data header | Analytic | N | N |
| 104 | Write MTP USB Data header | Analytic | N | N |
| 105 | MTP USB Control Transfer GetStatus request | Analytic | N | N |
| 106 | MTP USB Control Transfer DeviceReset request | Analytic | N | N |
| 107 | MTP USB Control Transfer CancelIO request | Analytic | N | N |
| 200 | Send MTP Multisession USB SendCommand | Analytic | N | N |
| 201 | Received MTP Multisession USB StartData block | Analytic | N | N |
| 202 | Received MTP Multisession USB Response block | Analytic | N | N |
| 203 | Received MTP Multisession USB DataHeader block | Analytic | N | N |
| 204 | Received MTP Multisession USB Event block | Analytic | N | N |
| 205 | Received MTP Multisession USB EndData block | Analytic | N | N |
| 206 | Received MTP Multisession USB Unknown block | Analytic | N | N |
| 207 | Sending MTP Multisession USB StartData block | Analytic | N | N |
| 208 | Sending MTP Multisession USB DataHeader block | Analytic | N | N |
Event ID 102: Received MTP USB Device Event
#Fields #
| Name | Description |
|---|---|
MTPUSLength UInt32 | |
MTPUSData Binary |
Event ID 105: MTP USB Control Transfer GetStatus request
#Fields #
| Name | Description |
|---|---|
WINUSB_SETUP_PACKET_LENGTH UInt16 | |
WINUSB_SETUP_PACKET Binary | |
ControlTransferBufferLength UInt32 | |
ControlTransferBuffer Binary |
Event ID 106: MTP USB Control Transfer DeviceReset request
#Fields #
| Name | Description |
|---|---|
WINUSB_SETUP_PACKET_LENGTH UInt16 | |
WINUSB_SETUP_PACKET Binary |
Event ID 107: MTP USB Control Transfer CancelIO request
#Fields #
| Name | Description |
|---|---|
WINUSB_SETUP_PACKET_LENGTH UInt16 | |
WINUSB_SETUP_PACKET Binary | |
ControlTransferBufferLength UInt32 | |
ControlTransferBuffer Binary |
Event ID 200: Send MTP Multisession USB SendCommand
#Fields #
| Name | Description |
|---|---|
MTPUSLength UInt32 | |
MTPUSData Binary |
Event ID 201: Received MTP Multisession USB StartData block
#Fields #
| Name | Description |
|---|---|
MTPUSLength UInt32 | |
MTPUSData Binary |
Event ID 202: Received MTP Multisession USB Response block
#Fields #
| Name | Description |
|---|---|
MTPUSLength UInt32 | |
MTPUSData Binary |
Event ID 203: Received MTP Multisession USB DataHeader block
#Fields #
| Name | Description |
|---|---|
MTPUSLength UInt32 | |
MTPUSData Binary |
Event ID 204: Received MTP Multisession USB Event block
#Fields #
| Name | Description |
|---|---|
MTPUSLength UInt32 | |
MTPUSData Binary |
Event ID 205: Received MTP Multisession USB EndData block
#Fields #
| Name | Description |
|---|---|
MTPUSLength UInt32 | |
MTPUSData Binary |
Event ID 206: Received MTP Multisession USB Unknown block
#Fields #
| Name | Description |
|---|---|
MTPUSLength UInt32 | |
MTPUSData Binary |
Provenance
ETW provider GUID dcfc4489-9ce0-403c-99df-a05422c60898
Defined in wpd_ci.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB