Windows Driver Frameworks: USB Device Plug/Unplug Events (Event IDs 2003, 2100, 2102)
Flags USB device plug/unplug related Driver Frameworks User-Mode events using Windows event IDs 2003, 2100, and 2102.
- Product
- windows
- Service
- driver-framework
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2017-11-09
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows DriverFrameworks UserMode operational activity associated with USB device plug/unplug or related PnP/power management changes. Attackers commonly rely on removable media and peripheral connections to reach a system, so tracking these device lifecycle events can help identify unusual attachment activity. The detection relies on Microsoft-Windows-DriverFrameworks-UserMode/Operational events with Event IDs 2003, 2100, and 2102.
Reporting behind it
- df-stream.comhttps://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/
- techrepublic.comhttps://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/driverframeworks/win_usb_device_plugged.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Driver Frameworks: USB Device Plug/Unplug Events (Event IDs 2003, 2100, 2102)"
id: a55e1f1c-ee1f-422a-95c7-656a133016be
status: test
description: This rule flags Windows DriverFrameworks UserMode operational activity associated with USB device plug/unplug or related PnP/power management changes. Attackers commonly rely on removable media and peripheral connections to reach a system, so tracking these device lifecycle events can help identify unusual attachment activity. The detection relies on Microsoft-Windows-DriverFrameworks-UserMode/Operational events with Event IDs 2003, 2100, and 2102.
references:
- https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/
- https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/driverframeworks/win_usb_device_plugged.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-11-09
modified: 2021-11-30
tags:
- attack.initial-access
- attack.t1200
logsource:
product: windows
service: driver-framework
definition: Requires enabling and collection of the Microsoft-Windows-DriverFrameworks-UserMode/Operational eventlog
detection:
selection:
EventID:
- 2003
- 2100
- 2102
condition: selection
falsepositives:
- Legitimate administrative activity
level: low
license: DRL-1.1
related:
- id: 1a4bd6e3-4c6e-405d-a9a3-53a116e341d4
type: derived