Windows security log: Device installation blocked by system policy (Event ID 6423)

title: "Windows security log: Device installation blocked by system policy (Event ID 6423)"
id: 7c885098-f7ba-4910-9543-a6138e65a274
status: test
description: This rule flags Windows Security auditing events where a device installation is blocked because it violates system policy. Attackers may trigger or probe these controls to test enforcement or attempt to bypass device restrictions. Detection relies on the Windows Security log event ID 6423.
references:
  - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6423
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_device_installation_blocked.yml
author: frack113, Huntrule Team
date: 2022-10-14
tags:
  - attack.initial-access
  - attack.t1200
logsource:
  service: security
  product: windows
detection:
  selection:
    EventID: 6423
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: c9eb55c3-b468-40ab-9089-db2862e42137
    type: derived