Windows WPDBusEnum Registry Key Modification

name: Windows WPDBusEnum Registry Key Modification
id: 52b48e8b-eb6e-48b0-b8f1-73273f6b134e
version: 8
creation_date: '2025-01-17'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: This analytic is used to identify when a USB removable media device is attached to a Windows host. In this scenario we are querying the Endpoint Registry data model to look for modifications to the Windows Portable Device keys HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ . Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
data_source:
    - Sysmon EventID 12
    - Sysmon EventID 13
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime, max(_time) as lastTime, count FROM datamodel=Endpoint.Registry
      WHERE Registry.registry_path IN ("HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\\*","HKLM\\System\\CurrentControlSet\\Enum\\SWD\\WPDBUSENUM\\*")
        AND
        Registry.registry_value_name ="FriendlyName"
        AND
        Registry.registry_path="*USBSTOR*"
      BY Registry.action Registry.dest Registry.process_guid
         Registry.process_id Registry.registry_hive Registry.registry_path
         Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
         Registry.registry_value_type Registry.status Registry.user
         Registry.vendor_product
    | `drop_dm_object_name(Registry)`
    | eval object_handle = registry_value_data, object_name = replace(mvindex(split(mvindex(split(registry_path, "??"),1),"&"),2),"PROD_","")
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_wpdbusenum_registry_key_modification_filter`
how_to_implement: To successfully implement this search, you must ingest endpoint logging that tracks changes to the HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ registry keys. Ensure that the field from the event logs is being mapped to the proper fields in the Endpoint.Registry data model.
known_false_positives: Legitimate USB activity will also be detected. Please verify and investigate as appropriate.
references:
    - https://attack.mitre.org/techniques/T1200/
    - https://www.cisa.gov/news-events/news/using-caution-usb-drives
    - https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A removable storage device named [$object_name$] with drive letter [$object_handle$] was attached to $dest$
threat_objects:
    - field: object_handle
      type: registry_value_text
    - field: object_name
      type: registry_value_name
analytic_story:
    - Data Protection
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1200
    - T1025
    - T1091
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint