Windows Event ID 6424 — The installation of this device was allowed after a policy override — SecOps Tools

Why event 6424 matters

Policy bypass for device installation. Who authorized the override? Attackers with admin access may override policies to install USB devices for data exfiltration.

How to detect it

Alert on every occurrence. Verify who performed the override and whether it was authorized.

Log source

Security

Advanced Audit Policy — enable the 'Plug and Play' subcategory (Success and/or Failure).

Fields to pivot on

SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic	Technique
Exfiltration	Exfiltration over USB (T1052.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

SecurityEvent
| where EventID == 6424   // The installation of this device was allowed after a policy override
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Security" EventCode=6424
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The installation of this device was allowed after a policy override — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Hunt event 6424 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Plug and Play events

6416 A new external device was recognized by the system 6419 A request was made to disable a device 6420 A device was disabled 6421 A request was made to enable a device 6422 A device was enabled 6423 The installation of this device is forbidden by system policy

Frequently asked questions

What is Windows Event ID 6424?

The installation of this device was allowed after a policy override. A device installation normally blocked by policy was allowed via override.

Which log records event 6424?

Event 6424 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Plug and Play' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 6424?

Event 6424 is associated with: Exfiltration over USB (T1052.001).

How do you detect activity around event 6424?

Alert on every occurrence. Verify who performed the override and whether it was authorized.