{"id":"f69a87ea-955e-4fb4-adb2-bb9fd6685632","title":"External Disk Drive Or USB Storage Device Was Recognized By The System","description":"Detects external disk drives or plugged-in USB devices.","author":"Keith Wright","status":"test","level":"low","date":"2019-11-20","modified":"2024-02-09","tags":["attack.t1091","attack.t1200","attack.lateral-movement","attack.initial-access"],"technique_ids":["T1091","T1200"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Likely"],"references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6416"],"source_path":"rules/windows/builtin/security/win_security_external_device.yml","source_sha256":"607a2f082171444aac232bd5654aa28b201c84ed7ceeb84a48246d2edc281157","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_external_device.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: External Disk Drive Or USB Storage Device Was Recognized By The System\nid: f69a87ea-955e-4fb4-adb2-bb9fd6685632\nstatus: test\ndescription: Detects external disk drives or plugged-in USB devices.\nreferences:\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6416\nauthor: Keith Wright\ndate: 2019-11-20\nmodified: 2024-02-09\ntags:\n    - attack.t1091\n    - attack.t1200\n    - attack.lateral-movement\n    - attack.initial-access\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection_eid:\n        EventID: 6416\n    selection_field:\n        - ClassName: 'DiskDrive'\n        - DeviceDescription: 'USB Mass Storage Device'\n    condition: all of selection_*\nfalsepositives:\n    - Likely\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1091","id":"T1091","name":"Replication Through Removable Media","page":"techniques/enterprise/T1091/"},{"key":"enterprise/T1200","id":"T1200","name":"Hardware Additions","page":"techniques/enterprise/T1200/"}],"data_path":"data/detection-rules/f69a87ea-955e-4fb4-adb2-bb9fd6685632.json","kind":"sigma"}