Alert for each time a usb device is plugged

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Alert for each time a usb device is plugged

L0 Member


Is there any way to set up an alert for each time a USB device is plugged into a host?
Even if it's not malicious.


Thanks... Microsoft TechDoc doesn't specify if its enabled by default Monitor the use of removable storage devices (Windows 10) - Windows security | Microsoft Docs


Open windows event viewer and go to 

Applications and Service Logs > Microsoft > Windows > DriverFrameworks-UserMode

as shown in the pic1




Double click there and you will see the value is 0 

Right click on it and select properties. You will find enable logging check box empty. See pic2


I believe it should be possible to propagate this setting through all your endpoints using GPO instead of manually configuring each endpoint.





Additionally in the registry we see that the enable value is 0 for the registry key 


Changing the value to 1 should also work








Hi @eluis and @jtalton 


For monitoring any new USB device it will be Event-ID 6416 but for monitoring removable media which is already registered by the system it will be 4719. So i guess a BIOC with a combination of 6416 and 4719 Event ID will help.





Kind Regards

L1 Bithead

Very interesting solution @eluis @jtalton 

I'm referencing this Cortex XDR documentation:


Will those Events (6416 & 4719) be collected automatically or would it be necessary to use the Broker VM to collect this additional IDs?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!