Windows Security Event 6416 for USB Mass Storage Device Plug-In or DiskDrive Recognition
Flags Windows Event ID 6416 entries where a DiskDrive/USB Mass Storage Device is detected as connected.
- Product
- windows
- Service
- security
- Author
- Keith Wright (SigmaHQ), DRL 1.1
- Published
- 2019-11-20
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Lateral MovementRecon
Resource Dev
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows Security audit events indicating that an external disk drive or a plugged-in USB mass storage device was recognized by the system. Attackers can use removable media to introduce tools or files for initial access or lateral movement, making device plug-in events a useful indicator of suspicious activity. It relies on Windows Security logs capturing EventID 6416 with DiskDrive class and DeviceDescription set to USB Mass Storage Device.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Security Event 6416 for USB Mass Storage Device Plug-In or DiskDrive Recognition
id: f9b1781b-cbf3-49ac-ab71-8fb494d853a0
status: test
description: This rule identifies Windows Security audit events indicating that an external disk drive or a plugged-in USB mass storage device was recognized by the system. Attackers can use removable media to introduce tools or files for initial access or lateral movement, making device plug-in events a useful indicator of suspicious activity. It relies on Windows Security logs capturing EventID 6416 with DiskDrive class and DeviceDescription set to USB Mass Storage Device.
references:
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6416
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_external_device.yml
author: Keith Wright, Huntrule Team
date: 2019-11-20
modified: 2024-02-09
tags:
- attack.t1091
- attack.t1200
- attack.lateral-movement
- attack.initial-access
logsource:
product: windows
service: security
detection:
selection_eid:
EventID: 6416
selection_field:
- ClassName: DiskDrive
- DeviceDescription: USB Mass Storage Device
condition: all of selection_*
falsepositives:
- Likely
level: low
license: DRL-1.1
related:
- id: f69a87ea-955e-4fb4-adb2-bb9fd6685632
type: derived