Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
32 detections
Filters
Last updated
All Time
Detection languages
16
7
4
4
1
Contributors
6
5
4
3
3
Categories
7
5
3
2
2
Platforms
22
6
1
1
Products / Services
8
4
4
3
2
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
IDS Classtypes
4
IDS Protocols
2
1
1
KQL Query from file: BadSuccessor Detection
USB Device Plugged
Sigma
Detects plugged/unplugged USB devices
Detects an installation of a device that is forbidden by the system policy
Detects external disk drives or plugged-in USB devices.
The analytic detects port security violations on Cisco switches by leveraging logs from Cisco network devices. It specifically looks for events with mnemonics indicating port security violations. This activity is significant because it indicates an unauthorized device attempting to connect to a secured port, potentially bypassing network access controls. If confirmed malicious, this could allow an attacker to gain unauthorized access to the network, leading to data exfiltration, network disruption, or further lateral movement within the environment.
This rule detects when a USB device is plugged in or unplugged by monitoring specific event IDs from the Microsoft-Windows-DriverFrameworks-UserMode/Operational event log. Event ID 2003 indicates driver loading, while Event IDs 2100 and 2102 relate to Plug and Play (PnP) or power management events, which are typically generated when a USB device is connected or disconnected.
This rule detects when an external disk drive or a USB mass storage device is recognized by the system. It specifically looks for Windows Security Event ID 6416, which indicates that a new external device was recognized, and further filters for devices classified as 'DiskDrive' or with the description 'USB Mass Storage Device'. This can be an indicator of initial access, data exfiltration, or the introduction of malicious software via removable media.
Detects an attempt to install a device that is forbidden by the system policy, indicated by Windows Security Event ID 6423. This event signifies that a device installation was blocked due to a configured policy.
USB Device Plugged
Sigma
Detects plugged/unplugged USB devices
Detects external disk drives or plugged-in USB devices.
Detects an installation of a device that is forbidden by the system policy
Page 2 of 2