USB Device Plugged

 1title: USB Device Plugged
 2id: 1a4bd6e3-4c6e-405d-a9a3-53a116e341d4
 3status: test
 4description: Detects plugged/unplugged USB devices
 5references:
 6    - https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/
 7    - https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/
 8author: Florian Roth (Nextron Systems)
 9date: 2017-11-09
10modified: 2021-11-30
11tags:
12    - attack.initial-access
13    - attack.t1200
14logsource:
15    product: windows
16    service: driver-framework
17    definition: 'Requires enabling and collection of the Microsoft-Windows-DriverFrameworks-UserMode/Operational eventlog'
18detection:
19    selection:
20        EventID:
21            - 2003  # Loading drivers
22            - 2100  # Pnp or power management
23            - 2102  # Pnp or power management
24    condition: selection
25falsepositives:
26    - Legitimate administrative activity
27level: low

References

• The Windows 7 Event Log and USB Device Tracking - Digital Forensics Stream

  

  Recently, there have been a few blog posts discussing evidence found on a system when USB devices are connected and removed (Yogesh Khatri’s blog series and Nicole Ibrahim’s blog).  I’ve been meaning to release this post for a while and Yogesh and Nicole’s posts have motivated me to do so.  Much of the conversation regarding USB device […]

  
  Read More

• How to track down USB flash drive usage with Windows 10's Event Viewer | TechRepublic

  

  Whether you're conducting a digital forensics investigation or troubleshooting USB flash drive connections, Event Viewer can provide what you need.

  
  Read More

Related rules

• Device Installation Blocked
• External Disk Drive Or USB Storage Device Was Recognized By The System
• ADSelfService Exploitation
• AWS Suspicious SAML Activity
• Account Disabled or Blocked for Sign in Attempts