Event ID 6416: A new external device was recognized by the system
Written when Windows sees a new plug-and-play device, such as a USB drive.
- Log
- Security
- Category
- Device
Why it matters
- Useful for investigating data taken out on USB, or malware brought in on it.
What to check
Check Device Description, Class Name and the hardware IDs.
How to turn it on
Advanced Audit Policy: Detailed Tracking > Audit PNP Activity.
MITRE ATT&CK
- T1091 Replication Through Removable Media