AN0185 Analytic 0185

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Chain: (1) a new external device is recognized by Windows (USB/Thunderbolt/PCIe) or a new block device appears; (2) within a short window, the same user/session spawns processes or the OS mounts a new volume; (3) optional follow-on activity such as HID keystroke injection, DMA driver load, or new network interface MAC on DHCP. Correlate Security EID 6416 / Kernel-PnP with sysmon and DHCP/network metadata.</p>

Detects: T1200 Hardware Additions
Part of: DET0069 Detect unauthorized or suspicious Hardware Additions (USB/Thunderbolt/Network)

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
WinEventLog:Security	`EventCode=6416`	DC0038 Application Log Content
WinEventLog:Sysmon	`EventCode=1`	DC0032 Process Creation
WinEventLog:Sysmon	`EventCode=6`	DC0079 Driver Load
WinEventLog:Sysmon	`EventCode=7`	DC0016 Module Load
WinEventLog:Sysmon	`EventCode=11`	DC0039 File Creation
WinEventLog:Sysmon	`EventCode=3, 22`	DC0082 Network Connection Creation
WinEventLog:System	`Kernel-PnP 410/400 device install, disk added`	DC0042 Drive Creation
wineventlog:dhcp	`DHCP Lease Granted`	DC0078 Network Traffic Flow

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`TrustedDeviceVIDPID`	Vendor/Product IDs that are approved (e.g., keyboards, mice). Unknown/rare VID:PID raise risk.
`ExpectedBusTypes`	Allow-listed bus types for server classes (e.g., USB disabled on DCs).
`TimeWindow`	Correlation window between device recognition and follow-on process/mount/network activity (e.g., 10m–60m).
`TrustedMACs`	Known NIC/USB-NIC MAC addresses allowed by policy.