Possible USB Device Plugged (via driver-framework)

title: Possible USB Device Plugged (via driver-framework)
id: 61b146c2-ffc5-5ab1-a57b-9322e682fa62
status: stable
description: This rule detects plugged/unplugged USB devices
references:
    - https://attack.mitre.org/techniques/T1200/
    - https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/
    - https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/
author: Huntrule Team
date: 2026-03-09
tags:
    - attack.initial-access
    - attack.t1200
logsource:
    product: windows
    service: driver-framework
    definition: 'Requires enabling and collection of the Microsoft-Windows-DriverFrameworks-UserMode/Operational eventlog'
detection:
    selection:
        EventID:
            - 2003
            - 2100
            - 2102
    condition: selection
falsepositives:
    - Unknown
level: low