AN1353
Analytic 1353
Windows
Suspicious enumeration of attached peripherals via WMI, PowerShell, or low-level API calls potentially chained with removable device interactions.
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=10
[CommandLineRegex]
Regex patterns for device enumeration utilities (e.g., 'Get-PnpDevice', 'wmic path Win32_USBController')
[TimeWindow]
Time threshold for grouping device discovery with follow-on access or manipulation
[UserContext]
Filter privileged or service accounts known to legitimately execute enumeration scripts
AN1354
Analytic 1354
Linux
Enumeration of USB and other peripheral hardware via udevadm, lshw, or /sys or /proc interfaces in proximity to collection or mounting behavior.
auditd:SYSCALL
execve
auditd:SYSCALL
open/read
linux:osquery
hardware_events
[ExecutableList]
Set of binaries used for peripheral enumeration (e.g., 'lshw', 'lsusb', 'udevadm')
[UserContext]
Tuning based on which users/scripts are authorized to query device state
AN1355
Analytic 1355
macOS
Execution of system utilities like 'system_profiler' and 'ioreg' to enumerate hardware components or USB devices, particularly if followed by clipboard, file, or network activity.
macos:unifiedlog
process exec
macos:osquery
usb_devices
[BinaryList]
Commands like 'system_profiler SPUSBDataType', 'ioreg -p IOUSB' that may indicate enumeration
[TimeWindow]
Temporal grouping of enumeration with follow-on activity (e.g., clipboard capture, exfiltration)