Alert for each time a usb device is plugged

[JoaoSantos20]

Hello,

Is there any way to set up an alert for each time a USB device is plugged into a host?
Even if it's not malicious.

[jtalton]

Thanks... Microsoft TechDoc doesn't specify if its enabled by default Monitor the use of removable storage devices (Windows 10) - Windows security | Microsoft Docs

[eluis]

Open windows event viewer and go to 

Applications and Service Logs > Microsoft > Windows > DriverFrameworks-UserMode

as shown in the pic1

Double click there and you will see the value is 0 

Right click on it and select properties. You will find enable logging check box empty. See pic2

I believe it should be possible to propagate this setting through all your endpoints using GPO instead of manually configuring each endpoint.

KR,

Luis

[eluis]

Additionally in the registry we see that the enable value is 0 for the registry key 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-DriverFrameworks-UserMode/Operational

Changing the value to 1 should also work

KR,

Luis

[KanwarSingh01]

Hi @eluis and @jtalton 

For monitoring any new USB device it will be Event-ID 6416 but for monitoring removable media which is already registered by the system it will be 4719. So i guess a BIOC with a combination of 6416 and 4719 Event ID will help.

[micomi]

Very interesting solution @eluis @jtalton 

I'm referencing this Cortex XDR documentation: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/customiza...

Will those Events (6416 & 4719) be collected automatically or would it be necessary to use the Broker VM to collect this additional IDs?