title: USB Device Plugged
id: 1a4bd6e3-4c6e-405d-a9a3-53a116e341d4
status: test
description: Detects plugged USB devices
author: Florian Roth
references:
  - https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/
  - https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/
date: 2017/11/09
modified: 2021/11/30
logsource:
  product: windows
  service: driver-framework
  definition: mapping Provider_Name 'Microsoft-Windows-DriverFrameworks-UserMode/Operational'
detection:
  selection:
    EventID:
      - 2003        # Loading drivers
      - 2100        # Pnp or power management
      - 2102        # Pnp or power management
  condition: selection
falsepositives:
  - Legitimate administrative activity
level: low
tags:
  - attack.initial_access
  - attack.t1200