Device Installation Blocked by Policy

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•21

Detects an attempt to install a device that is forbidden by the system policy, indicated by Windows Security Event ID 6423. This event signifies that a device installation was blocked due to a configured policy.