Suspicious Device Deployment Blocked (via security)

title: Suspicious Device Deployment Blocked (via security)
id: 7f141469-ed00-5224-9968-622249e2e39d
status: stable
description: This rule detects an installation of a device that is forbidden by the system policy
references:
    - https://attack.mitre.org/techniques/T1200/
    - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6423
author: Huntrule Team
date: 2026-01-01
tags:
    - attack.initial-access
    - attack.t1200
logsource:
    service: security
    product: windows
detection:
    selection:
        EventID: 6423
    condition: selection
falsepositives:
    - Unknown
level: medium