External device of a code-execution or network class attached

Siemphony@siemphonylowT1200unverifiedPlaybook · Unexpected execution

Matches Security EventID 6416, "a new external device was recognized by the system", narrowed to the device classes that can carry a hardware addition rather than merely store data: human interface devices (keystroke injection), network adapters (rogue USB-NIC or adversary-in-the-middle tap) and disk or SCSI controllers (DMA-capable and mass-storage arrivals). The logsource is the Security channel, so `EventID` is matched explicitly. MITRE's AN0185 is a correlation — device arrival, then a volume mount or process spawn by the same session inside TimeWindow, optionally a new MAC taking a DHCP lease — and none of that is expressible in Sigma, so this is the arrival leg only. Coverage for this technique is inherently weak: 6416 records that a device appeared, not whether it is malicious, and the VID/PID allowlisting MITRE relies on has to happen outside the rule. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0069, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: External device of a code-execution or network class attached2id: 04e9bd1e-47a5-40b9-9650-254b34a31f483status: experimental4description: |5  Matches Security EventID 6416, "a new external device was recognized by the6  system", narrowed to the device classes that can carry a hardware addition7  rather than merely store data: human interface devices (keystroke injection),8  network adapters (rogue USB-NIC or adversary-in-the-middle tap) and disk or9  SCSI controllers (DMA-capable and mass-storage arrivals). The logsource is the10  Security channel, so `EventID` is matched explicitly. MITRE's AN0185 is a11  correlation — device arrival, then a volume mount or process spawn by the same12  session inside TimeWindow, optionally a new MAC taking a DHCP lease — and none13  of that is expressible in Sigma, so this is the arrival leg only. Coverage for14  this technique is inherently weak: 6416 records that a device appeared, not15  whether it is malicious, and the VID/PID allowlisting MITRE relies on has to16  happen outside the rule.17  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0069, not hand-written and not tested by its author. Any lab result is on this rule's own page.18references:19  - https://attack.mitre.org/techniques/T120020  - https://attack.mitre.org/detectionstrategies/DET006921author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)22date: 2026-08-1623tags:24  - attack.initial-access25  - attack.t120026logsource:27  product: windows28  service: security29detection:30  selection:31    EventID: 641632    ClassName:33      - 'HIDClass'34      - 'Net'35      - 'DiskDrive'36      - 'SCSIAdapter'37  condition: selection38falsepositives:39  - "Everyday peripheral use on workstations and laptops. A user plugging in a keyboard, mouse, headset, dock or USB hub emits HIDClass arrivals constantly, and a dock also brings a Net-class adapter with it. MITRE's TrustedDeviceVIDPID and TrustedMACs knobs are the intended filter, and neither is available in the 6416 fields this rule matches, so the practical deployment is to scope the rule to the ServerClassesNoUSB population — domain controllers, hypervisors and other hosts where any external attach is policy-violating."40  - "Corporate imaging, repair and provisioning work, where technicians attach external drives, USB-to-Ethernet adapters and bootable media as a routine part of the job, generating DiskDrive and Net arrivals in bulk during a build window."41  - "Virtual and remote-desktop sessions that redirect client peripherals into the guest, which surface as fresh device recognitions on the guest at every logon even though no physical hardware was added."42  - "Docking and undocking a laptop, which replays the whole peripheral set through 6416 several times a day per user."43level: low

Sentinel · KQL

Run this as a search.

SecurityEvent| where (EventID == 6416 and (ClassName =~ "HIDClass" or ClassName =~ "Net" or ClassName =~ "DiskDrive" or ClassName =~ "SCSIAdapter"))

Splunk · SPL

Run this as a search.

index=* (EventID="6416" AND (ClassName="HIDClass" OR ClassName="Net" OR ClassName="DiskDrive" OR ClassName="SCSIAdapter"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (event.code == 6416 AND (TO_LOWER(winlog.event_data.ClassName) == "hidclass" OR TO_LOWER(winlog.event_data.ClassName) == "net" OR TO_LOWER(winlog.event_data.ClassName) == "diskdrive" OR TO_LOWER(winlog.event_data.ClassName) == "scsiadapter"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^6416$</field>    <field name="ClassName" type="pcre2">(?i)(^HIDClass$|^Net$|^DiskDrive$|^SCSIAdapter$)</field>    <description>External device of a code-execution or network class attached</description>    <mitre>      <id>T1200</id>    </mitre>  </rule></group>

At a glance

Logsource: security / windows
Level: low
Category: exploitation_initial_access
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 04e9bd1e-47a5-40b9-9650-254b34a31f48

ATT&CKT1200

T1200Hardware Additions

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1200, evaluated against their — events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Scope by population, not by field. MITRE's TrustedDeviceVIDPID and
Drop DiskDrive, or split it into a separate rule tagged attack.t1091.
Consider adding USB, USBDevice, Ports and System if the target

Declared by the author

Everyday peripheral use on workstations and laptops. A user plugging in a keyboard, mouse, headset, dock or USB hub emits HIDClass arrivals constantly, and a dock also brings a Net-class adapter with it. MITRE's TrustedDeviceVIDPID and TrustedMACs knobs are the intended filter, and neither is available in the 6416 fields this rule matches, so the practical deployment is to scope the rule to the ServerClassesNoUSB population — domain controllers, hypervisors and other hosts where any external attach is policy-violating.
Corporate imaging, repair and provisioning work, where technicians attach external drives, USB-to-Ethernet adapters and bootable media as a routine part of the job, generating DiskDrive and Net arrivals in bulk during a build window.
Virtual and remote-desktop sessions that redirect client peripherals into the guest, which surface as fresh device recognitions on the guest at every logon even though no physical hardware was added.
Docking and undocking a laptop, which replays the whole peripheral set through 6416 several times a day per user.

Lessonexploitation initial access

exploitation initial accessAI draft — unreviewed

01 · What this rule detects

Security EventID 6416 — "a new external device was recognized by the system" — narrowed to four device classes. Before anything else about the logic: 6416 is not logged on a default Windows install. It requires the Audit PnP Activity subcategory under Advanced Audit Policy → Detailed Tracking, which is Not Configured on every client and server edition out of the box, and which neither the CIS nor the Microsoft security baselines turn on. Deploy this rule on a stock estate and it returns zero rows forever. Sit with what that means. A detection with zero hits looks identical on a dashboard to one that is working and finding nothing. Green tile, no alerts, technique marked covered on the ATT&CK heat map. The rule is not quiet — it is blind, and it cannot tell you which. That is the most dangerous failure mode in detection engineering, because it converts absent telemetry into an appearance of safety, and the reviewer graded it high severity above every logic defect here. Your first action on this rule is never triage; it is running auditpol /get /subcategory:"Plug and Play Events" on a representative host. MITRE's AN0185 is, as usual, a correlation — device arrival, then a volume mount or process spawn by the same session inside TimeWindow, optionally a new MAC taking a DHCP lease. Sigma expresses none of that. This is the arrival leg alone.

02 · Telemetry you need

Windows Security channel with Audit PnP Activity enabled. Everything else is
Nothing further. 6416 carries ClassName, ClassId, VendorIds,

03 · How the logic works

Why `EventID` is written out. The logsource is product: windows, service: security — the raw channel, not a Sigma taxonomy category. Nothing pre-filters the event type, so without this line ClassName would be evaluated against every Security event in the channel. The brief's note says exactly that: "match EventID in detection." Why these four classes. The intent is classes that can carry a hardware addition rather than merely store data: HIDClass for keystroke injection (a Rubber Ducky enumerates here and matches cleanly), Net for a rogue USB-NIC or an adversary-in-the-middle tap, SCSIAdapter and DiskDrive for DMA-capable and mass-storage arrivals. DiskDrive is the weak one. T1200's own text carves out plain removable storage — "Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media)" — so every USB stick becomes a T1200 Initial Access hit when it is T1091. A real DMA device enumerates as SCSIAdapter, System or a PCI class, not DiskDrive, so the arm does not buy the coverage its justification claims. ClassName is an exact-match list, which cuts the other way too: a composite implant surfacing as USB or USBDevice, a serial Ports device, a tethered phone under WPD, or a Thunderbolt device under System all walk past while being precisely the hardware additions this technique is about.

04 · Common false positives

On a workstation fleet this is unrunnable and the rule says so. Keyboards, mice, headsets, docks and hubs emit HIDClass constantly; a dock brings a Net adapter with it; docking and undocking replays the whole peripheral set several times a day per user. Technicians generate DiskDrive and Net arrivals in bulk. VDI and RDP redirect client peripherals into the guest, producing fresh recognitions at every logon with no physical hardware involved. The reviewer added two more: OEM driver packs and Windows Update re-enumerate hardware that was already present, replaying 6416 fleet-wide on patch Tuesday, and hypervisor provisioning does the same for synthetic Net adapters on every VM build.

05 · Detection maturity

tier_1: , and unusually far from Tier 2.** UNVERIFIED — derived from MITRE ATT&CK DET0069 and never executed against a log line. The field work is correct: EventID and ClassName are both genuine 6416 event-data fields, with nothing borrowed from a neighbouring event type.
tier_2: starts with the audit policy, not the query. Enable Audit PnP Activity on a pilot group, confirm 6416 is arriving in your SIEM, then measure volume. Skipping that step is how a rule reaches production with a permanently empty result set and a green tile above it.
tier_3: restores MITRE's chain — arrival joined to a mount, process spawn or DHCP lease inside TimeWindow — correlation that lives outside Sigma entirely.

Share this rule

/u/siemphony/04e9bd1e-47a5-40b9-9650-254b34a31f48

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

External device of a code-execution or network class attached

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it