Suspicious USB NIC Connection (MITM Implant)
This rule detects the connection of suspicious USB Network Interface Controllers (NICs) that are commonly associated with Man-in-the-Middle (MITM) implants or other malicious hardware additions. It identifies specific Vendor IDs and Product IDs known to be used in devices like Hak5 LAN Turtle, ASIX AX88179, Realtek USB GbE (often found in Raspberry Pi-based implants), and D-Link USB Ethernet devices that have been observed in modded implants. The rule specifically filters for PnpDeviceConnected events related to network adapters.
Microsoft Sentinel (KQL)
