USB Device Plugged

Title: USB Device Plugged
Status: test
Description:Detects plugged/unplugged USB devices
References:
  -https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/
  -https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/
Author: Florian Roth (Nextron Systems)
Date: 2017-11-09
modified:2021-11-30
Tags:

• -'attack.initial-access'
• -'attack.t1200'

Logsource:

• product: windows
• service: driver-framework
• definition: Requires enabling and collection of the Microsoft-Windows-DriverFrameworks-UserMode/Operational eventlog

Detection:
  selection:
    EventID:
      -'2003'
      -'2100'
      -'2102'

  condition:selection
Falsepositives:
  -Legitimate administrative activity
Level: low