Suspicious USB NIC Chipset Detected
This rule detects the connection of USB Network Interface Controllers (NICs) with specific Vendor and Product IDs known to be associated with suspicious devices often used in Man-in-the-Middle (MITM) implants. These include devices like the Hak5 LAN Turtle, Realtek USB GbE adapters (often found in Raspberry Pi-based implants), and D-Link USB Ethernet adapters that have been observed in modified implants. The rule specifically filters for 'PnpDeviceConnected' events where the device class is a network adapter.
Microsoft Sentinel (KQL)
