A new external device (USB, disk, etc.) was plugged in. DeviceId and DeviceDescription are key.
USB-based data exfiltration (T1052.001), BadUSB attacks (malicious HID devices), hardware keyloggers. Unexpected USB device insertions on servers are highly suspicious.
Alert: USB device inserted into servers or sensitive workstations. Alert: HID devices (keyboards, mice) inserted unexpectedly. Baseline expected devices — deviations warrant investigation.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Exfiltration | Exfiltration Over Physical Medium: Exfiltration over USB (T1052.001) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: Unexpected USB Device Inserted
status: experimental
description: External device inserted — possible data exfiltration or BadUSB
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: security
detection:
selection:
EventID: 6416
condition: selection
falsepositives:
- Authorized USB device usage
- Known devices
level: medium
tags:
- attack.exfiltration
- attack.t1052.001SecurityEvent
| where EventID == 6416 // A new external device was recognized by the system
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=6416
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A new external device was recognized by the system — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`A new external device was recognized by the system. A new external device (USB, disk, etc.) was plugged in. DeviceId and DeviceDescription are key.
Event 6416 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Plug and Play' subcategory (Success and/or Failure).
Event 6416 is associated with: Exfiltration Over Physical Medium: Exfiltration over USB (T1052.001).
Alert: USB device inserted into servers or sensitive workstations. Alert: HID devices (keyboards, mice) inserted unexpectedly. Baseline expected devices — deviations warrant investigation.