From 28804bb170085605a6e84c0637e587c4279b9f4f Mon Sep 17 00:00:00 2001
From: rathbuna <36825567+rathbuna@users.noreply.github.com>
Date: Sat, 9 Jan 2021 12:44:49 -0500
Subject: [PATCH 01/11] Update
 Microsoft-Windows-TerminalServices-LocalSessionManager-Operational_Microsoft-Windows-TerminalServices-LocalSessionManager_40.map

---
 ...icrosoft-Windows-TerminalServices-LocalSessionManager_40.map | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/evtx/Maps/Microsoft-Windows-TerminalServices-LocalSessionManager-Operational_Microsoft-Windows-TerminalServices-LocalSessionManager_40.map b/evtx/Maps/Microsoft-Windows-TerminalServices-LocalSessionManager-Operational_Microsoft-Windows-TerminalServices-LocalSessionManager_40.map
index 1e807d85..66210521 100644
--- a/evtx/Maps/Microsoft-Windows-TerminalServices-LocalSessionManager-Operational_Microsoft-Windows-TerminalServices-LocalSessionManager_40.map
+++ b/evtx/Maps/Microsoft-Windows-TerminalServices-LocalSessionManager-Operational_Microsoft-Windows-TerminalServices-LocalSessionManager_40.map
@@ -24,7 +24,7 @@ Lookups:
     Default: Unknown code
     Values:
         0: No additional information is available (i.e. the user has closed RDP window)
-        5: The client’s connection was replaced by another connection (i.e. a user reconected to a previous RDP session)
+        5: The client’s connection was replaced by another connection (i.e. a user reconnected to a previous RDP session)
         11: User activity has initiated the disconnect
  
 # Documentation:

From c0bf3b6d35823089e01e7045a6e5487827f4e380 Mon Sep 17 00:00:00 2001
From: rathbuna <36825567+rathbuna@users.noreply.github.com>
Date: Sat, 9 Jan 2021 13:38:43 -0500
Subject: [PATCH 02/11] Create
 Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_145.map

---
 ...Operational_Microsoft-Windows-Ntfs_145.map | 78 +++++++++++++++++++
 1 file changed, 78 insertions(+)
 create mode 100644 evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_145.map

diff --git a/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_145.map b/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_145.map
new file mode 100644
index 00000000..cdd6e316
--- /dev/null
+++ b/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_145.map
@@ -0,0 +1,78 @@
+Author: Andrew Rathbun
+Description: NTFS-formatted drive attached
+EventId: 145
+Channel: "Microsoft-Windows-Ntfs/Operational"
+Provider: "Microsoft-Windows-Ntfs"
+Maps:
+  -
+    Property: PayloadData1
+    PropertyValue: "VolumeName: %VolumeName%"
+    Values:
+      -
+        Name: VolumeName
+        Value: "/Event/EventData/Data[@Name=\"VolumeName\"]"
+  -
+    Property: PayloadData2
+    PropertyValue: "IsBootVolume: %IsBootVolume%"
+    Values:
+      -
+        Name: IsBootVolume
+        Value: "/Event/EventData/Data[@Name=\"IsBootVolume\"]"
+  -
+    Property: PayloadData3
+    PropertyValue: "VolumeCorrelationId: %VolumeCorrelationId%"
+    Values:
+      -
+        Name: VolumeCorrelationId
+        Value: "/Event/EventData/Data[@Name=\"VolumeCorrelationId\"]"
+
+# Documentation:
+# https://forensixchange.com/posts/19_08_03_usb_storage_forensics_1/
+#
+# Example Event Data:
+#<Event>
+#  <System>
+#    <Provider Name="Microsoft-Windows-Ntfs" Guid="3dd37a1c-a68d-4d6e-8c9b-f79e8b16c482" />
+#    <EventID>145</EventID>
+#    <Version>2</Version>
+#    <Level>4</Level>
+#    <Task>0</Task>
+#    <Opcode>0</Opcode>
+#    <Keywords>0x4000000000204000</Keywords>
+#    <TimeCreated SystemTime="2020-10-22 15:18:02.3775706" />
+#    <EventRecordID>4419</EventRecordID>
+#    <Correlation />
+#    <Execution ProcessID="4" ThreadID="16500" />
+#    <Channel>Microsoft-Windows-Ntfs/Operational</Channel>
+#    <Computer>HOSTNAME.domain.com</Computer>
+#    <Security UserID="S-1-5-18" />
+#  </System>
+#  <EventData>
+#    <Data Name="VolumeCorrelationId">c679d0d4-1476-11eb-bad3-34f39ae13aac</Data>
+#    <Data Name="VolumeNameLength">0</Data>
+#    <Data Name="VolumeName"></Data>
+#    <Data Name="IsBootVolume">False</Data>
+#    <Data Name="MaxLatencyMs">30000</Data>
+#    <Data Name="ReadWriteLatencyBucket1">5000000</Data>
+#    <Data Name="ReadWriteLatencyBucket2">30000000</Data>
+#    <Data Name="ReadWriteLatencyBucket3">100000000</Data>
+#    <Data Name="ReadWriteLatencyBucket4">0</Data>
+#    <Data Name="ReadWriteLatencyBucket5">0</Data>
+#    <Data Name="ReadWriteLatencyBucket6">0</Data>
+#    <Data Name="ReadWriteLatencyBucket7">0</Data>
+#    <Data Name="TrimLatencyBucket1">10000000</Data>
+#    <Data Name="TrimLatencyBucket2">50000000</Data>
+#    <Data Name="TrimLatencyBucket3">100000000</Data>
+#    <Data Name="TrimLatencyBucket4">0</Data>
+#    <Data Name="TrimLatencyBucket5">0</Data>
+#    <Data Name="TrimLatencyBucket6">0</Data>
+#    <Data Name="TrimLatencyBucket7">0</Data>
+#    <Data Name="FlushLatencyBucket1">10000000</Data>
+#    <Data Name="FlushLatencyBucket2">50000000</Data>
+#    <Data Name="FlushLatencyBucket3">100000000</Data>
+#    <Data Name="FlushLatencyBucket4">0</Data>
+#    <Data Name="FlushLatencyBucket5">0</Data>
+#    <Data Name="FlushLatencyBucket6">0</Data>
+#    <Data Name="FlushLatencyBucket7">0</Data>
+#  </EventData>
+#</Event>

From 9aaf4db24da492f1e0a36b7bb0ff48277eb0c364 Mon Sep 17 00:00:00 2001
From: rathbuna <36825567+rathbuna@users.noreply.github.com>
Date: Sat, 9 Jan 2021 13:38:46 -0500
Subject: [PATCH 03/11] Create
 Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map

---
 ...Operational_Microsoft-Windows-Ntfs_142.map | 66 +++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map

diff --git a/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map b/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map
new file mode 100644
index 00000000..41196e6b
--- /dev/null
+++ b/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map
@@ -0,0 +1,66 @@
+Author: Andrew Rathbun
+Description: NTFS-formatted drive attached
+EventId: 142
+Channel: "Microsoft-Windows-Ntfs/Operational"
+Provider: "Microsoft-Windows-Ntfs"
+Maps:
+  -
+    Property: PayloadData1
+    PropertyValue: "VolumeName: %VolumeName%"
+    Values:
+      -
+        Name: VolumeName
+        Value: "/Event/EventData/Data[@Name=\"VolumeName\"]"
+  -
+    Property: PayloadData2
+    PropertyValue: "IsBootVolume: %IsBootVolume%"
+    Values:
+      -
+        Name: IsBootVolume
+        Value: "/Event/EventData/Data[@Name=\"IsBootVolume\"]"
+  -
+    Property: PayloadData3
+    PropertyValue: "LowestFreeSpaceInBytes: %LowestFreeSpaceInBytes%"
+    Values:
+      -
+        Name: LowestFreeSpaceInBytes
+        Value: "/Event/EventData/Data[@Name=\"LowestFreeSpaceInBytes\"]"
+  -
+    Property: PayloadData4
+    PropertyValue: "HighestFreeSpaceInBytes: %HighestFreeSpaceInBytes%"
+    Values:
+      -
+        Name: HighestFreeSpaceInBytes
+        Value: "/Event/EventData/Data[@Name=\"HighestFreeSpaceInBytes\"]"
+
+# Documentation:
+# https://forensixchange.com/posts/19_08_03_usb_storage_forensics_1/
+# Free space and volume name of the attached drive can be derived from this event.
+#
+# Example Event Data:
+#<Event>
+#  <System>
+#    <Provider Name="Microsoft-Windows-Ntfs" Guid="3ff37a1c-a68d-43de-8c9b-f79e8b16c482" />
+#    <EventID>142</EventID>
+#    <Version>0</Version>
+#    <Level>4</Level>
+#    <Task>0</Task>
+#    <Opcode>0</Opcode>
+#    <Keywords>0x4000000000200900</Keywords>
+#    <TimeCreated SystemTime="2020-10-13 06:11:22.2517941" />
+#    <EventRecordID>385</EventRecordID>
+#    <Correlation />
+#    <Execution ProcessID="4" ThreadID="27824" />
+#    <Channel>Microsoft-Windows-Ntfs/Operational</Channel>
+#    <Computer>HOSTNAME.domain.com</Computer>
+#    <Security />
+#  </System>
+#  <EventData>
+#    <Data Name="VolumeGuid">6f349c04-b41a-4cb0-91bb-8c7742123937</Data>
+#    <Data Name="VolumeNameLength">48</Data>
+#    <Data Name="VolumeName">\\?\Volume{6f349c04-b41a-4cb0-91bb-8c7742123937}</Data>
+#    <Data Name="LowestFreeSpaceInBytes">132669440</Data>
+#    <Data Name="HighestFreeSpaceInBytes">132669440</Data>
+#    <Data Name="IsBootVolume">False</Data>
+#  </EventData>
+#</Event>

From 6a03a24f1d4a672389da350395b95d3157182f06 Mon Sep 17 00:00:00 2001
From: rathbuna <36825567+rathbuna@users.noreply.github.com>
Date: Sat, 9 Jan 2021 13:44:18 -0500
Subject: [PATCH 04/11] Update
 Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map

---
 ...oft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map b/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map
index 41196e6b..352ea6d3 100644
--- a/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map
+++ b/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map
@@ -36,6 +36,9 @@ Maps:
 # Documentation:
 # https://forensixchange.com/posts/19_08_03_usb_storage_forensics_1/
 # Free space and volume name of the attached drive can be derived from this event.
+# Events are created during the first connection since the startup. 
+# So if the user removes the drive and attaches it again no new logs are going to be made according to my investigation.
+
 #
 # Example Event Data:
 #<Event>

From c8e5740750343eab8cad95b7af9119cc9f4a51bd Mon Sep 17 00:00:00 2001
From: rathbuna <36825567+rathbuna@users.noreply.github.com>
Date: Sat, 9 Jan 2021 13:44:23 -0500
Subject: [PATCH 05/11] Update
 Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_145.map

---
 ...soft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_145.map | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_145.map b/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_145.map
index cdd6e316..6b52a64c 100644
--- a/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_145.map
+++ b/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_145.map
@@ -28,6 +28,8 @@ Maps:
 
 # Documentation:
 # https://forensixchange.com/posts/19_08_03_usb_storage_forensics_1/
+# Events are created during the first connection since the startup. 
+# So if the user removes the drive and attaches it again no new logs are going to be made according to my investigation.
 #
 # Example Event Data:
 #<Event>

From fab809e954b835368aff68612fe77e5488a95335 Mon Sep 17 00:00:00 2001
From: rathbuna <36825567+rathbuna@users.noreply.github.com>
Date: Sat, 9 Jan 2021 14:27:45 -0500
Subject: [PATCH 06/11] Create System_Microsoft-Windows-UserPnp_20001.map

---
 ...System_Microsoft-Windows-UserPnp_20001.map | 109 ++++++++++++++++++
 1 file changed, 109 insertions(+)
 create mode 100644 evtx/Maps/System_Microsoft-Windows-UserPnp_20001.map

diff --git a/evtx/Maps/System_Microsoft-Windows-UserPnp_20001.map b/evtx/Maps/System_Microsoft-Windows-UserPnp_20001.map
new file mode 100644
index 00000000..e19f86f7
--- /dev/null
+++ b/evtx/Maps/System_Microsoft-Windows-UserPnp_20001.map
@@ -0,0 +1,109 @@
+Author: Andrew Rathbun
+Description: Device installation
+EventId: 20001
+Channel: System
+Provider: "Microsoft-Windows-UserPnp"
+Maps: 
+  - 
+    Property: PayloadData1
+    PropertyValue: "DriverDescription: %DriverDescription%"
+    Values: 
+      - 
+        Name: DriverDescription
+        Value: "/Event/UserData/InstallDeviceID/DriverDescription"
+  - 
+    Property: PayloadData2
+    PropertyValue: "InstallStatus: %InstallStatus%"
+    Values: 
+      - 
+        Name: InstallStatus
+        Value: "/Event/UserData/InstallDeviceID/InstallStatus"
+  - 
+    Property: PayloadData3
+    PropertyValue: "IsDriverOEM: %IsDriverOEM%"
+    Values: 
+      - 
+        Name: IsDriverOEM
+        Value: "/Event/UserData/InstallDeviceID/IsDriverOEM"
+  - 
+    Property: PayloadData4
+    PropertyValue: "UpgradeDevice: %UpgradeDevice%"
+    Values: 
+      - 
+        Name: UpgradeDevice
+        Value: "/Event/UserData/InstallDeviceID/UpgradeDevice"
+  - 
+    Property: PayloadData5
+    PropertyValue: "RebootOption: %RebootOption%"
+    Values: 
+      - 
+        Name: RebootOption
+        Value: "/Event/UserData/InstallDeviceID/RebootOption"
+  -
+    Property: PayloadData6
+    PropertyValue: "DeviceInstanceID: %DeviceInstanceID%"
+    Values: 
+      - 
+        Name: DeviceInstanceID
+        Value: "/Event/UserData/InstallDeviceID/DeviceInstanceID"
+  - 
+    Property: ExecutableInfo
+    PropertyValue: "%DriverName%"
+    Values: 
+      - 
+        Name: DriverName
+        Value: "/Event/UserData/InstallDeviceID/DriverName"
+
+Lookups: 
+  -
+    Name: InstallStatus
+    Default: Unknown code
+    Values:
+        0x0: Installation Successful
+        0x00000002: File Not Found
+        0x80070002: File Not Found
+        0x80070003: Path Not Found
+        0x80070005: Access Denied
+        0x800F0233: Invalid Target
+        0x8028006E: Invalid Source Path
+        0x000005B3: Requires Interactive Workstation
+        0x000005B4: Timeout
+        0xE0000234: Driver Non-native
+        0xE0000246: Device Installer Not Ready
+
+# Documentation:
+# https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc756336(v=ws.10)?redirectedfrom=MSDN
+#
+# Example Event Data:
+#<Event>
+#  <System>
+#    <Provider Name="Microsoft-Windows-UserPnp" Guid="96f4a050-7e31-453c-88be-9634f4e02139" />
+#    <EventID>20001</EventID>
+#    <Version>0</Version>
+#    <Level>4</Level>
+#    <Task>7005</Task>
+#    <Opcode>0</Opcode>
+#    <Keywords>0x8000000500000000</Keywords>
+#    <TimeCreated SystemTime="2020-10-19 18:15:14.4350230" />
+#    <EventRecordID>80566</EventRecordID>
+#    <Correlation />
+#    <Execution ProcessID="3528" ThreadID="1020" />
+#    <Channel>System</Channel>
+#    <Computer>HOSTNAME.domain.com</Computer>
+#    <Security UserID="S-1-5-18" />
+#  </System>
+#  <UserData>
+#    <InstallDeviceID>
+#      <DriverName>intcdaud.inf_amd64_46799624fe0dfa08\intcdaud.inf</DriverName>
+#      <DriverVersion>6.16.0.3208</DriverVersion>
+#      <DriverProvider>Intel(R) Corporation</DriverProvider>
+#      <DeviceInstanceID>HDAUDIO\FUNC_01&amp;amp;VEN_8086&amp;amp;DEV_2807&amp;amp;SUBSYS_80860101&amp;amp;REV_1000\4&amp;amp;2BFF37FD&amp;amp;1&amp;amp;0001</DeviceInstanceID>
+#      <SetupClass>4d13e96c-e325-11ce-bfc1-08002be10318</SetupClass>
+#      <RebootOption>False</RebootOption>
+#      <UpgradeDevice>True</UpgradeDevice>
+#      <IsDriverOEM>True</IsDriverOEM>
+#      <InstallStatus>0x0</InstallStatus>
+#      <DriverDescription>Intel(R) Display Audio</DriverDescription>
+#    </InstallDeviceID>
+#  </UserData>
+#</Event>

From 10cfee3c6f64ffde377f60d1be11f6e0a27afdc2 Mon Sep 17 00:00:00 2001
From: rathbuna <36825567+rathbuna@users.noreply.github.com>
Date: Sat, 9 Jan 2021 14:51:54 -0500
Subject: [PATCH 07/11] Create System_Microsoft-Windows-UserPnp_20003.map

---
 ...System_Microsoft-Windows-UserPnp_20003.map | 100 ++++++++++++++++++
 1 file changed, 100 insertions(+)
 create mode 100644 evtx/Maps/System_Microsoft-Windows-UserPnp_20003.map

diff --git a/evtx/Maps/System_Microsoft-Windows-UserPnp_20003.map b/evtx/Maps/System_Microsoft-Windows-UserPnp_20003.map
new file mode 100644
index 00000000..d2678271
--- /dev/null
+++ b/evtx/Maps/System_Microsoft-Windows-UserPnp_20003.map
@@ -0,0 +1,100 @@
+Author: Andrew Rathbun
+Description: Service installation
+EventId: 20003
+Channel: System
+Provider: "Microsoft-Windows-UserPnp"
+Maps: 
+  - 
+    Property: PayloadData1
+    PropertyValue: "ServiceName: %ServiceName%"
+    Values: 
+      - 
+        Name: ServiceName
+        Value: "/Event/UserData/AddServiceID/ServiceName"
+  - 
+    Property: PayloadData2
+    PropertyValue: "AddServiceStatus: %AddServiceStatus%"
+    Values: 
+      - 
+        Name: AddServiceStatus
+        Value: "/Event/UserData/AddServiceID/AddServiceStatus"
+  - 
+    Property: PayloadData4                                                  	
+    PropertyValue: "UpdateService: %UpdateService%"
+    Values: 
+      - 
+        Name: UpdateService
+        Value: "/Event/UserData/AddServiceID/UpdateService"
+  - 
+    Property: PayloadData5
+    PropertyValue: "PrimaryService: %PrimaryService%"
+    Values: 
+      - 
+        Name: PrimaryService
+        Value: "/Event/UserData/AddServiceID/PrimaryService"
+  -
+    Property: PayloadData6
+    PropertyValue: "DeviceInstanceID: %DeviceInstanceID%"
+    Values: 
+      - 
+        Name: DeviceInstanceID
+        Value: "/Event/UserData/AddServiceID/DeviceInstanceID"
+  - 
+    Property: ExecutableInfo
+    PropertyValue: "%DriverFileName%"
+    Values: 
+      - 
+        Name: DriverFileName
+        Value: "/Event/UserData/AddServiceID/DriverFileName"
+
+Lookups: 
+  -
+    Name: AddServiceStatus
+    Default: Unknown code
+    Values:
+        0x0: Installation Successful
+        0x00000002: File Not Found
+        0x80070002: File Not Found
+        0x80070003: Path Not Found
+        0x80070005: Access Denied
+        0x800F0233: Invalid Target
+        0x8028006E: Invalid Source Path
+        0x000005B3: Requires Interactive Workstation
+        0x000005B4: Timeout
+        0xE0000234: Driver Non-native
+        0xE0000246: Device Installer Not Ready
+        0xE0000217: Driver Non-native
+        0xE0000219: Device Installer Not Ready
+
+# Documentation:
+# https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd349407(v=ws.10)
+#
+# Example Event Data:
+#<Event>
+#  <System>
+#    <Provider Name="Microsoft-Windows-UserPnp" Guid="96f4a050-7e31-453c-88be-9634f4e02139" />
+#    <EventID>20003</EventID>
+#    <Version>0</Version>
+#    <Level>4</Level>
+#    <Task>7005</Task>
+#    <Opcode>0</Opcode>
+#    <Keywords>0x8000000500000000</Keywords>
+#    <TimeCreated SystemTime="2020-10-19 18:15:14.4350230" />
+#    <EventRecordID>80566</EventRecordID>
+#    <Correlation />
+#    <Execution ProcessID="3528" ThreadID="1020" />
+#    <Channel>System</Channel>
+#    <Computer>HOSTNAME.domain.com</Computer>
+#    <Security UserID="S-1-5-18" />
+#  </System>
+#  <UserData>
+#    <AddServiceID>
+#      <ServiceName>usbaudio</ServiceName>
+#      <DriverFileName>\SystemRoot\system32\drivers\usbaudio.sys</DriverFileName>
+#      <DeviceInstanceID>USB\VID_0B0E&amp;amp;PID_245E&amp;amp;MI_00\6&amp;amp;549A665&amp;amp;0&amp;amp;0000</DeviceInstanceID>
+#      <PrimaryService>True</PrimaryService>
+#      <UpdateService>True</UpdateService>
+#      <AddServiceStatus>0</AddServiceStatus>
+#    </AddServiceID>
+#  </UserData>
+#</Event>

From 2029267da12a1b7ea15600926a658dd8823e9e3f Mon Sep 17 00:00:00 2001
From: rathbuna <36825567+rathbuna@users.noreply.github.com>
Date: Sat, 9 Jan 2021 15:56:01 -0500
Subject: [PATCH 08/11] Create
 Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_430.map

---
 ...ation_Microsoft-Windows-Kernel-PnP_430.map | 39 +++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 evtx/Maps/Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_430.map

diff --git a/evtx/Maps/Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_430.map b/evtx/Maps/Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_430.map
new file mode 100644
index 00000000..4b60fc81
--- /dev/null
+++ b/evtx/Maps/Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_430.map
@@ -0,0 +1,39 @@
+Author: Andrew Rathbun
+Description: Device requires further installation
+EventId: 430
+Channel: "Microsoft-Windows-Kernel-PnP/Configuration"
+Provider: "Microsoft-Windows-Kernel-PnP"
+Maps: 
+- 
+    Property: PayloadData6
+    PropertyValue: "DeviceInstanceId: %DeviceInstanceId%"
+    Values: 
+      - 
+        Name: DeviceInstanceId
+        Value: "/Event/EventData/Data[@Name=\"DeviceInstanceId\"]"
+
+# Documentation:
+# https://forensixchange.com/posts/19_08_03_usb_storage_forensics_1/
+#
+# Example Event Data:
+#<Event>
+#  <System>
+#    <Provider Name="Microsoft-Windows-Kernel-PnP" Guid="9c455a39-1250-487d-abd7-e831c6290539" />
+#    <EventID>430</EventID>
+#    <Version>0</Version>
+#    <Level>4</Level>
+#    <Task>0</Task>
+#    <Opcode>0</Opcode>
+#    <Keywords>0x4000000090000000</Keywords>
+#    <TimeCreated SystemTime="2019-10-17 03:18:15.2790188" />
+#    <EventRecordID>3314</EventRecordID>
+#    <Correlation />
+#    <Execution ProcessID="4" ThreadID="660" />
+#    <Channel>Microsoft-Windows-Kernel-PnP/Configuration</Channel>
+#    <Computer>HOSTNAME.domain.com</Computer>
+#    <Security UserID="S-1-5-18" />
+#  </System>
+#  <EventData>
+#    <Data Name="DeviceInstanceId">SWD\WPDBUSENUM\_??_USBSTOR#Disk&amp;amp;Ven_iDRAC&amp;amp;Prod_MAS001&amp;amp;Rev_0329#20120731&amp;amp;0#{53g76307-b6bf-11d0-94f2-00a0c13dfb8b}</Data>
+#  </EventData>
+#</Event>

From af50975bdd5eb0543703f6f11548bb85e0b1eef1 Mon Sep 17 00:00:00 2001
From: rathbuna <36825567+rathbuna@users.noreply.github.com>
Date: Sat, 9 Jan 2021 15:56:05 -0500
Subject: [PATCH 09/11] Create
 Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_410.map

---
 ...ation_Microsoft-Windows-Kernel-PnP_410.map | 75 +++++++++++++++++++
 1 file changed, 75 insertions(+)
 create mode 100644 evtx/Maps/Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_410.map

diff --git a/evtx/Maps/Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_410.map b/evtx/Maps/Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_410.map
new file mode 100644
index 00000000..4c223b1e
--- /dev/null
+++ b/evtx/Maps/Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_410.map
@@ -0,0 +1,75 @@
+Author: Andrew Rathbun
+Description: Device driver error
+EventId: 410
+Channel: "Microsoft-Windows-Kernel-PnP/Configuration"
+Provider: "Microsoft-Windows-Kernel-PnP"
+Maps: 
+- 
+    Property: PayloadData1
+    PropertyValue: "ServiceName: %ServiceName%"
+    Values: 
+      - 
+        Name: ServiceName
+        Value: "/Event/EventData/Data[@Name=\"ServiceName\"]"
+  - 
+    Property: PayloadData2
+    PropertyValue: "Problem: %Problem%"
+    Values: 
+      - 
+        Name: Problem
+        Value: "/Event/EventData/Data[@Name=\"Problem\"]"
+  - 
+    Property: PayloadData3
+    PropertyValue: "Status: %Status%"
+    Values: 
+      - 
+        Name: Status
+        Value: "/Event/EventData/Data[@Name=\"Status\"]"
+  -
+    Property: PayloadData6
+    PropertyValue: "DeviceInstanceID: %DeviceInstanceID%"
+    Values: 
+      - 
+        Name: DeviceInstanceID
+        Value: "/Event/EventData/Data[@Name=\"DeviceInstanceID\"]"
+  - 
+    Property: ExecutableInfo
+    PropertyValue: "%DriverName%"
+    Values: 
+      - 
+        Name: DriverName
+        Value: "/Event/EventData/Data[@Name=\"DriverName\"]"
+
+# Documentation:
+# https://answers.microsoft.com/en-us/windows/forum/windows_8-hardware/event-410-kernel-pnp-logged-for-my-keyboard-the/36772d4b-8217-473e-8ffe-9e0b6b7f4cfa
+# https://forensixchange.com/posts/19_08_03_usb_storage_forensics_1/
+#
+# Example Event Data:
+#<Event>
+#  <System>
+#    <Provider Name="Microsoft-Windows-Kernel-PnP" Guid="9c205a39-1250-487d-abd7-e831c6290539" />
+#    <EventID>410</EventID>
+#    <Version>0</Version>
+#    <Level>4</Level>
+#    <Task>0</Task>
+#    <Opcode>0</Opcode>
+#    <Keywords>0x4000000090000000</Keywords>
+#    <TimeCreated SystemTime="2019-08-30 17:58:17.3774575" />
+#    <EventRecordID>3067</EventRecordID>
+#    <Correlation />
+#    <Execution ProcessID="4" ThreadID="9600" />
+#    <Channel>Microsoft-Windows-Kernel-PnP/Configuration</Channel>
+#    <Computer>HOSTNAME.domain.com</Computer>
+#    <Security UserID="S-1-5-18" />
+#  </System>
+#  <EventData>
+#    <Data Name="DeviceInstanceId">SWD\ScDeviceEnum\6_Windows_Hello_for_Business_1</Data>
+#    <Data Name="DriverName">c_swdevice.inf</Data>
+#    <Data Name="ClassGuid">62f9c741-b25a-46ce-b54c-9bccce08b6f2</Data>
+#    <Data Name="ServiceName"></Data>
+#    <Data Name="LowerFilters"></Data>
+#    <Data Name="UpperFilters"></Data>
+#    <Data Name="Problem">0x0</Data>
+#    <Data Name="Status">0x0</Data>
+#  </EventData>
+#</Event>

From f3f0056fc67caf163f295419defd84d85f50eeae Mon Sep 17 00:00:00 2001
From: rathbuna <36825567+rathbuna@users.noreply.github.com>
Date: Sat, 9 Jan 2021 15:56:07 -0500
Subject: [PATCH 10/11] Create
 Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_400.map

---
 ...ation_Microsoft-Windows-Kernel-PnP_400.map | 96 +++++++++++++++++++
 1 file changed, 96 insertions(+)
 create mode 100644 evtx/Maps/Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_400.map

diff --git a/evtx/Maps/Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_400.map b/evtx/Maps/Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_400.map
new file mode 100644
index 00000000..d536cba3
--- /dev/null
+++ b/evtx/Maps/Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_400.map
@@ -0,0 +1,96 @@
+Author: Andrew Rathbun
+Description: Device driver error
+EventId: 400
+Channel: "Microsoft-Windows-Kernel-PnP/Configuration"
+Provider: "Microsoft-Windows-Kernel-PnP"
+Maps: 
+  - 
+    Property: PayloadData1
+    PropertyValue: "MatchingDeviceId: %MatchingDeviceId%"
+    Values: 
+      - 
+        Name: MatchingDeviceId
+        Value: "/Event/EventData/Data[@Name=\"MatchingDeviceId\"]"
+  - 
+    Property: PayloadData2
+    PropertyValue: "DriverSection: %DriverSection%"
+    Values: 
+      - 
+        Name: DriverSection
+        Value: "/Event/EventData/Data[@Name=\"DriverSection\"]"
+  - 
+    Property: PayloadData3
+    PropertyValue: "DriverProvider: %DriverProvider%"
+    Values: 
+      - 
+        Name: DriverProvider
+        Value: "/Event/EventData/Data[@Name=\"DriverProvider\"]"
+  - 
+    Property: PayloadData4                                                  	
+    PropertyValue: "DeviceUpdated: %DeviceUpdated%"
+    Values: 
+      - 
+        Name: DeviceUpdated
+        Value: "/Event/EventData/Data[@Name=\"DeviceUpdated\"]"
+  - 
+    Property: PayloadData5                                                  	
+    PropertyValue: "ParentDeviceInstanceId: %ParentDeviceInstanceId%"
+    Values: 
+      - 
+        Name: ParentDeviceInstanceId
+        Value: "/Event/EventData/Data[@Name=\"ParentDeviceInstanceId\"]"
+  -
+    Property: PayloadData6
+    PropertyValue: "DeviceInstanceID: %DeviceInstanceID%"
+    Values: 
+      - 
+        Name: DeviceInstanceID
+        Value: "/Event/EventData/Data[@Name=\"DeviceInstanceID\"]"
+  - 
+    Property: ExecutableInfo
+    PropertyValue: "%DriverName%"
+    Values: 
+      - 
+        Name: DriverName
+        Value: "/Event/EventData/Data[@Name=\"DriverName\"]"
+        
+# Documentation:
+# https://docs.microsoft.com/en-us/windows-hardware/drivers/install/driver-rank-ranges--windows-vista-and-later-
+# https://www.eventid.net/displayqueue.asp?eventid=400
+# https://forensixchange.com/posts/19_08_03_usb_storage_forensics_1/
+#
+# Example Event Data:
+#<Event>
+#  <System>
+#    <Provider Name="Microsoft-Windows-Kernel-PnP" Guid="9c679a39-1250-487d-abd7-e831c6290539" />
+#    <EventID>400</EventID>
+#    <Version>0</Version>
+#    <Level>4</Level>
+#    <Task>0</Task>
+#    <Opcode>0</Opcode>
+#    <Keywords>0x4000000500000000</Keywords>
+#    <TimeCreated SystemTime="2019-06-25 16:54:32.9955521" />
+#    <EventRecordID>2811</EventRecordID>
+#    <Correlation />
+#    <Execution ProcessID="4" ThreadID="4568" />
+#    <Channel>Microsoft-Windows-Kernel-PnP/Configuration</Channel>
+#    <Computer>HOSTNAME.domain.com</Computer>
+#    <Security UserID="S-1-5-18" />
+#  </System>
+#  <EventData>
+#    <Data Name="DeviceInstanceId">SWD\PRINTENUM\{3CDEEBDB-6F0B-4ECB-94CD-3151F17A3B59}</Data>
+#    <Data Name="DriverName">printqueue.inf</Data>
+#    <Data Name="ClassGuid">1ed2fff9-11f0-4084-b21f-ad83a8e6dcdc</Data>
+#    <Data Name="DriverDate">06/21/2006</Data>
+#    <Data Name="DriverVersion">10.0.14393.0</Data>
+#    <Data Name="DriverProvider">Microsoft</Data>
+#    <Data Name="DriverInbox">True</Data>
+#    <Data Name="DriverSection">NO_DRV_LOCAL</Data>
+#    <Data Name="DriverRank">0x1</Data>
+#    <Data Name="MatchingDeviceId">PRINTENUM\LocalPrintQueue</Data>
+#    <Data Name="OutrankedDrivers">oem0.inf:{013f01fa-e634-4d77-83ee-074817c03581}:00FF0002 c_swdevice.inf:SWD\GenericRaw:00FF3001</Data>
+#    <Data Name="DeviceUpdated">False</Data>
+#    <Data Name="Status">0x0</Data>
+#    <Data Name="ParentDeviceInstanceId">SWD\PRINTENUM\PrintQueues</Data>
+#  </EventData>
+#</Event>

From 67a7c757061da34c1a21caf9575fa8ddf570d36c Mon Sep 17 00:00:00 2001
From: rathbuna <36825567+rathbuna@users.noreply.github.com>
Date: Sat, 9 Jan 2021 15:58:18 -0500
Subject: [PATCH 11/11] Update
 Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map

---
 ...osoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map | 1 -
 1 file changed, 1 deletion(-)

diff --git a/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map b/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map
index 352ea6d3..6ce8cb5a 100644
--- a/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map
+++ b/evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_142.map
@@ -38,7 +38,6 @@ Maps:
 # Free space and volume name of the attached drive can be derived from this event.
 # Events are created during the first connection since the startup. 
 # So if the user removes the drive and attaches it again no new logs are going to be made according to my investigation.
-
 #
 # Example Event Data:
 #<Event>