Windows Security Event 6423: Device Installation Blocked by Policy
Alerts when Windows blocks a device installation due to enforced system policy (Event ID 6423).
- Product
- windows
- Service
- security
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-10-14
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Security log events indicating that a device installation was blocked because it is forbidden by system policy. Attackers may attempt to introduce unauthorized peripherals or drivers during initial access, and policy enforcement that blocks these actions is important for containment. Detection relies on Security audit telemetry specifically reporting EventID 6423.
Reporting behind it
- github.comhttps://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6423
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_device_installation_blocked.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security Event 6423: Device Installation Blocked by Policy"
id: 7c885098-f7ba-4910-9543-a6138e65a274
status: test
description: This rule flags Windows Security log events indicating that a device installation was blocked because it is forbidden by system policy. Attackers may attempt to introduce unauthorized peripherals or drivers during initial access, and policy enforcement that blocks these actions is important for containment. Detection relies on Security audit telemetry specifically reporting EventID 6423.
references:
- https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6423
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_device_installation_blocked.yml
author: frack113, Huntrule Team
date: 2022-10-14
tags:
- attack.initial-access
- attack.t1200
logsource:
service: security
product: windows
detection:
selection:
EventID: 6423
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: c9eb55c3-b468-40ab-9089-db2862e42137
type: derived