Query: detect Detects plugged/unplugged USB devices in logs
Matching passage: Sigma rule: Detects plugged/unplugged USB devices. Logsource: windows / driver-framework. Rule: title: USB Device Plugged id: 1a4bd6e3-4c6e-405d-a9a3-53a116e341d4 status: test description: Detects plugged/unplugged USB devices references: - https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/ - https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/ author: Florian Roth (Nextron Systems) date: 2017-11-09 modified: 2021-11-30 tags: - attack.initial-access - attack.t1200 logsource: product: windows service: driver-framework definition: Requires enabling and collection of the Microsoft-Windows-DriverFrameworks-UserMode/Operational eventlog detection: selection: EventID: - 2003 - 2100 - 2102 condition: selection falsepositives: - Legitimate administrative activity level: low
Near-miss passage: Sigma rule: Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the. Logsource: windows / registry_set. Rule: title: Register New IFiltre For Persistence id: b23818c7-e575-4d13-8012-332075ec0a2b status: test description: 'Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files. ' references: - https://persistence-info.github.io/Data/ifilters.html - https://twitter.com/0gtweet/status/1468548924600459267 - https://github.com/gtworek/PSBits/tree/master/IFilter - https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/IFilter/Dll.cpp#L281-L308 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2024-03-26 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection_ext: TargetObject|contains|all: - \SOFTWARE\Classes\. - \PersistentHandler selection_clsid: TargetObject|contains|all: - \SOFTWARE\Classes\CLSID - \PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF} filter_default_targets: TargetObject|contains: - \CLSID\{4F46F75F-199F-4C63-8B7D-86D48FE7970C}\ - \CLSID\{4887767F-7ADC-4983-B576-88FB643D6F79}\ - \CLSID\{D3B41FA1-01E3-49AF-AA25-1D0D824275AE}\ - \CLSID\{72773E1A-B711-4d8d-81FA-B9A43B0650DD}\ - \CLSID\{098f2470-bae0-11cd-b579-08002b30bfeb}\ - \CLSID\{1AA9BF05-9A97-48c1-BA28-D9DCE795E93C}\ - \CLSID\{2e2294a9-50d7-4fe7-a09f-e6492e185884}\ - \CLSID\{34CEAC8D-CBC0-4f77-B7B1-8A60CB6DA0F7}\ - \CLSID\{3B224B11-9363-407e-850F-C9E1FFACD8FB}\ - \CLSID\{3DDEB7A4-8ABF-4D82-B9EE-E1F4552E95BE}\ - \CLSID\{5645C8C1-E277-11CF-8FDA-00AA00A14F93}\ - \CLSID\{5645C8C4-E277-11CF-8FDA-00AA00A14F93}\ - \CLSID\{58A9EBF6-5755-4554-A67E-A2467AD1447B}\ - \CLSID\{5e941d80-bf96-11cd-b579-08002b30bfeb}\ - \CLSID\{698A4FFC-63A3-4E70-8F00-376AD29363FB}\ - \CLSID\{7E9D8D44-6926-426F-AA2B-217A819A5CCE}\ - \CLSID\{8CD34779-9F10-4f9b-ADFB-B3FAEABDAB5A}\ - \CLSID\{9694E38A-E081-46ac-99A0-8743C909ACB6}\ - \CLSID\{98de59a0-d175-11cd-a7bd-00006b827d94}\ - \CLSID\{AA10385A-F5AA-4EFF-B3DF-71B701E25E18}\ - \CLSID\{B4132098-7A03-423D-9463-163CB07C151F}\ - \CLSID\{d044309b-5da6-4633-b085-4ed02522e5a5}\ - \CLSID\{D169C14A-5148-4322-92C8-754FC9D018D8}\ - \CLSID\{DD75716E-B42E-4978-BB60-1497B92E30C4}\ - \CLSID\{E2F83EED-62DE-4A9F-9CD0-A1D40DCD13B6}\ - \CLSID\{E772CEB3-E203-4828-ADF1-765713D981B8}\ - \CLSID\{eec97550-47a9-11cf-b95