OpCodes.md

March 6, 2023 ยท View on GitHub

OpCodes

opcode: Contains a numeric value that identifies the activity or a point within an activity that the application was performing when it raised the event .

  • Powershell script to list all OpCodes, their Name & DisplayName for AllEvent providers:

    # OpCodes:

# Get all listprovider names into an array
$pnames = @((Get-WinEvent -ListLog * -ErrorAction SilentlyContinue).ProviderNames|sort-object|get-unique)
$pcount = $pnames.count
$e=0

$opcodes = foreach($p in $pnames){$e++;
        write-progress -activity "List provider:$($p) ->  $($e) of $($pcount)"  -PercentComplete (($e / $($pcount)) * 100)
        # get all opcodes for each listprovider (from the above array)            
        $listprovider = if(((Get-WinEvent -Listprovider $p -ErrorAction SilentlyContinue).events|select-object -property id, opcode).opcode -ne $false)
                        {((Get-WinEvent -Listprovider $p -ErrorAction SilentlyContinue).events|select-object -property id, opcode)}
        #format output
        foreach($i in $listprovider){
                [PSCustomObject]@{
                            Provider = $p
                            EventId = $i.id
                            '#' = $i.opcode.value.count
                            Value = $i.opcode.value
                            Name = $i.opcode.name
                            Displayname = $i.opcode.displayname
       }
    }
}
#output results to table
$opcodes|sort -property Provider, EventID, Value  |format-table -autosize

    • Sample Output

      ProviderEventIDCountValueNameDisplay Name
      LsaSrv622511win:StartStart
      LsaSrv622612win:StopStop
      LsaSrv622711win:StartStart
      LsaSrv622812win:StopStop
      LsaSrv622911win:StartStart
      LsaSrv623012win:StopStop
      LsaSrv623111win:StartStart
      LsaSrv623212win:StopStop

    • Sample Output when sorted by unique Name. (From 791 eventlog providers - Win10 Pro (version 1803) )
      $kw|sort -property Value, Name, Displayname -unique |format-table -autosize

      ProviderEventIDValueNameDisplayName
      AESMService00
      Microsoft-Windows-PriResources-Deployment10000win:Info
      Microsoft-Windows-SenseIR110win:InfoInfo
      Microsoft-Windows-PriResources-Deployment11win:Start
      Microsoft-Windows-Shell-Core189521win:StartStart
      Microsoft-Windows-PriResources-Deployment22win:Stop
      Microsoft-Windows-VolumeSnapshot-Driver1192win:StopStop
      Microsoft-WindowsPhone-ConfigManager2884win:DC_StopDCStop
      Microsoft-Windows-Bits-Client17win:ResumeResume
      Microsoft-Windows-Kernel-PnP2718win:SuspendSuspend
      Microsoft-Windows-Spell-Checking19win:SendSend
      Microsoft-Windows-Bits-Client1910AcceptPacketreplying to an incoming request
      Microsoft-Windows-GPIO-ClassExtension100010AcpiEventMethodStart
      Microsoft-Windows-Winsock-AFD401610AFD_OPCODE_OPENOpen