Windows Security Log: USB Mass Storage or DiskDrive Device Recognition (Event ID 6416)

title: "Windows Security Log: USB Mass Storage or DiskDrive Device Recognition (Event ID 6416)"
id: f9b1781b-cbf3-49ac-ab71-8fb494d853a0
status: test
description: This rule identifies when the Windows system recognizes an external disk drive or a plugged-in USB Mass Storage Device. Attackers commonly use removable media for initial access or lateral movement, so device recognition events can indicate when new storage is introduced to a host. The detection relies on Windows Security auditing Event ID 6416 telemetry, specifically matching the disk device class and the device description indicating USB mass storage.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6416
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_external_device.yml
author: Keith Wright, Huntrule Team
date: 2019-11-20
modified: 2024-02-09
tags:
  - attack.t1091
  - attack.t1200
  - attack.lateral-movement
  - attack.initial-access
logsource:
  product: windows
  service: security
detection:
  selection_eid:
    EventID: 6416
  selection_field:
    - ClassName: DiskDrive
    - DeviceDescription: USB Mass Storage Device
  condition: all of selection_*
falsepositives:
  - Likely
level: low
license: DRL-1.1
related:
  - id: f69a87ea-955e-4fb4-adb2-bb9fd6685632
    type: derived