A request was made to disable a hardware device.
Disabling security devices (hardware security keys, smartcard readers) or monitoring hardware. May also indicate disabling of network interfaces.
Alert: disabling of security-relevant devices (smartcard readers, biometric devices, network adapters).
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 6419 // A request was made to disable a device
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=6419
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A request was made to disable a device — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`A request was made to disable a device. A request was made to disable a hardware device.
Event 6419 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Plug and Play' subcategory (Success and/or Failure).
Alert: disabling of security-relevant devices (smartcard readers, biometric devices, network adapters).