Windows USB Device Plugged/Unplugged Events (Driver Framework User-Mode)

title: Windows USB Device Plugged/Unplugged Events (Driver Framework User-Mode)
id: a55e1f1c-ee1f-422a-95c7-656a133016be
status: test
description: This rule identifies USB device plug and unplug activity by matching Windows Driver Frameworks User-Mode operational events. Attackers can use newly connected USB devices for initial access or to deliver payloads, so tracking these system events helps surface unexpected device changes. It relies on Microsoft-Windows-DriverFrameworks-UserMode/Operational telemetry, specifically the event IDs 2003, 2100, and 2102.
references:
  - https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/
  - https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/driverframeworks/win_usb_device_plugged.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-11-09
modified: 2021-11-30
tags:
  - attack.initial-access
  - attack.t1200
logsource:
  product: windows
  service: driver-framework
  definition: Requires enabling and collection of the Microsoft-Windows-DriverFrameworks-UserMode/Operational eventlog
detection:
  selection:
    EventID:
      - 2003
      - 2100
      - 2102
  condition: selection
falsepositives:
  - Legitimate administrative activity
level: low
license: DRL-1.1
related:
  - id: 1a4bd6e3-4c6e-405d-a9a3-53a116e341d4
    type: derived