X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=blobdiff_plain;ds=sidebyside;f=etc%2Frules%2Fms1016_usbdetect_rules.xml;fp=etc%2Frules%2Fms1016_usbdetect_rules.xml;h=24fd6189d18f4d7ecd3b0d3be24dc04db5fc73c6;hb=3f728675941dc69d4e544d3a880a56240a6e394a;hp=0000000000000000000000000000000000000000;hpb=927951d1c1ad45ba9e7325f07d996154a91c911b;p=ossec-hids.git

diff --git a/etc/rules/ms1016_usbdetect_rules.xml b/etc/rules/ms1016_usbdetect_rules.xml
new file mode 100644
index 0000000..24fd618
--- /dev/null
+++ b/etc/rules/ms1016_usbdetect_rules.xml
@@ -0,0 +1,10 @@
+<!-- OSSEC USB-detection Rule for Windows 2016 / Windows 10 (previous versions does not log usb connection) - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6416 -->
+
+<group name="windows,usb,">
+  <rule id="53626" level="8">
+    <if_sid>18104</if_sid>
+    <id>^6416$</id>
+    <description>A new external device was recognized by the System</description>
+    <group>windows,</group>
+  </rule>
+</group>