Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
14
3
3
3
3
Contributors
9
5
3
3
2
Categories
11
7
6
6
5
Platforms
23
3
1
Products / Services
9
8
4
4
3
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
IDS Classtypes
3
IDS Protocols
1
1
1
Action "PnpDeviceConnected" reports the connection of any plug and play device.
Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416.
Query #1: look for rare one-time devices connected to a specific machine.
Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416.
Query #1: look for rare one-time devices connected to a specific machine.
Action "PnpDeviceConnected" reports the connection of any plug and play device.
Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416.
Query #1: look for rare one-time devices connected to a specific machine.
Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416.
Query #1: look for rare one-time devices connected to a specific machine.
Show usb mounted and files copied
Show usb mounted devices and drive letters
List all PnP Devices that have been allowed or blocked
Page 2 of 2