USB Device Plugged

Detects plugged/unplugged USB devices

Sigma rule (View on GitHub)

 1title: USB Device Plugged
 2id: 1a4bd6e3-4c6e-405d-a9a3-53a116e341d4
 3status: test
 4description: Detects plugged/unplugged USB devices
 5references:
 6    - https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/
 7    - https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/
 8author: Florian Roth (Nextron Systems)
 9date: 2017/11/09
10modified: 2021/11/30
11tags:
12    - attack.initial_access
13    - attack.t1200
14logsource:
15    product: windows
16    service: driver-framework
17    definition: 'Requires enabling and collection of the Microsoft-Windows-DriverFrameworks-UserMode/Operational eventlog'
18detection:
19    selection:
20        EventID:
21            - 2003  # Loading drivers
22            - 2100  # Pnp or power management
23            - 2102  # Pnp or power management
24    condition: selection
25falsepositives:
26    - Legitimate administrative activity
27level: low

References

Related rules

to-top