Device Installation Blocked
Detects an installation of a device that is forbidden by the system policy
Sigma rule (View on GitHub)
1title: Device Installation Blocked
2id: c9eb55c3-b468-40ab-9089-db2862e42137
3status: test
4description: Detects an installation of a device that is forbidden by the system policy
5references:
6 - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
7 - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6423
8author: frack113
9date: 2022/10/14
10tags:
11 - attack.initial_access
12 - attack.t1200
13logsource:
14 service: security
15 product: windows
16detection:
17 selection:
18 EventID: 6423
19 condition: selection
20falsepositives:
21 - Unknown
22level: medium
References
Related rules
- USB Device Plugged
- Account Disabled or Blocked for Sign in Attempts
- Account Tampering - Suspicious Failed Logon Reasons
- Apache Spark Shell Command Injection - ProcessCreation
- Application Using Device Code Authentication Flow