usb.json

{
  "dataset": {
    "name": "EID Quick Reference - USB / DriverFrameworks",
    "version": "1.5.0",
    "generatedAt": "2026-04-12T00:00:00Z",
    "id": "https://raw.githubusercontent.com/zerber0s/windows-eid-data/main/usb.json",
    "schema": "https://raw.githubusercontent.com/zerber0s/windows-eid-data/main/schema.json",
    "license": {
      "name": "Creative Commons Attribution 4.0 International",
      "spdx": "CC-BY-4.0",
      "notice": "Event descriptions are paraphrased summaries written for this dataset. Source links point to authoritative references."
    },
    "sources": [
      {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/",
        "type": "primary"
      }
    ]
  },
  "entries": [
    {
      "id": 2003,
      "log": "DriverFrameworks",
      "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
      "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
      "level": "Information",
      "title": "Device instance detected",
      "summary": "A USB device was connected and detected by Windows.",
      "details": "Generated when Windows detects a new device instance, typically when a USB device is physically connected. The device instance ID encodes the device class, vendor ID (VID), product ID (PID), and serial number (if the device has one). Devices without a serial number share an instance ID across connections, making per-connection attribution harder.",
      "category": "USB Device",
      "tags": [
        "usb",
        "removable-media",
        "physical-access",
        "insider-threat"
      ],
      "relatedEventIds": [
        {
          "id": 2004,
          "log": "DriverFrameworks"
        },
        {
          "id": 2100,
          "log": "DriverFrameworks"
        },
        {
          "id": 2101,
          "log": "DriverFrameworks"
        },
        {
          "id": 20001,
          "log": "System"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1091",
          "techniqueName": "Replication Through Removable Media",
          "tactics": [
            {
              "tacticId": "TA0001",
              "tacticName": "Initial Access"
            },
            {
              "tacticId": "TA0008",
              "tacticName": "Lateral Movement"
            }
          ]
        },
        {
          "techniqueId": "T1052.001",
          "techniqueName": "Exfiltration Over Physical Medium: Exfiltration over USB",
          "tactics": [
            {
              "tacticId": "TA0010",
              "tacticName": "Exfiltration"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Extract VID and PID from the device instance ID to identify the device class (storage, input, network adapter, etc.)",
          "Serial number presence in the instance ID enables per-device tracking across multiple connection events",
          "Correlate connection timestamps with user logon events (Security EID 4624) to attribute the device connection to a specific user session",
          "Correlate with EID 2004 to confirm the device was successfully initialized, and with System log EID 20001 for driver installation events"
        ],
        "commonFalsePositives": [
          "Any routine USB device connection (keyboards, mice, headsets, hubs)",
          "USB charging of personal devices"
        ]
      },
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows-hardware/drivers/wdf/user-mode-driver-framework-design-guide"
      },
      "volumeIndicator": "medium",
      "windowsVersions": {
        "minVersion": "Windows 8 / Server 2012"
      },
      "keyFields": [
        {
          "name": "DeviceInstanceId",
          "xpath": "EventData/Data[@Name='DeviceInstanceId']",
          "description": "Unique device identifier encoding device class, VID, PID, and serial number"
        }
      ],
      "lastReviewed": "2026-04-12"
    },
    {
      "id": 2004,
      "log": "DriverFrameworks",
      "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
      "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
      "level": "Information",
      "title": "Device instance enumerated",
      "summary": "A detected USB device was successfully enumerated by Windows.",
      "details": "Generated when Windows successfully enumerates a device instance following detection (EID 2003). Enumeration confirms the device was recognized and its properties read by the driver framework. A device that generates EID 2003 but not EID 2004 may indicate a driver failure or an unsupported device class.",
      "category": "USB Device",
      "tags": [
        "usb",
        "removable-media",
        "physical-access"
      ],
      "relatedEventIds": [
        {
          "id": 2003,
          "log": "DriverFrameworks"
        },
        {
          "id": 2100,
          "log": "DriverFrameworks"
        },
        {
          "id": 2101,
          "log": "DriverFrameworks"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1091",
          "techniqueName": "Replication Through Removable Media",
          "tactics": [
            {
              "tacticId": "TA0001",
              "tacticName": "Initial Access"
            },
            {
              "tacticId": "TA0008",
              "tacticName": "Lateral Movement"
            }
          ]
        },
        {
          "techniqueId": "T1052.001",
          "techniqueName": "Exfiltration Over Physical Medium: Exfiltration over USB",
          "tactics": [
            {
              "tacticId": "TA0010",
              "tacticName": "Exfiltration"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Pair with EID 2003 using the device instance ID to confirm successful device recognition",
          "Device present in EID 2003 but absent in EID 2004 may indicate a blocked or unsupported device"
        ],
        "commonFalsePositives": [
          "Any legitimate USB device being connected and enumerated normally"
        ]
      },
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows-hardware/drivers/wdf/user-mode-driver-framework-design-guide"
      },
      "volumeIndicator": "medium",
      "windowsVersions": {
        "minVersion": "Windows 8 / Server 2012"
      },
      "keyFields": [
        {
          "name": "DeviceInstanceId",
          "xpath": "EventData/Data[@Name='DeviceInstanceId']",
          "description": "Device instance identifier matching the EID 2003 detection event"
        }
      ],
      "lastReviewed": "2026-04-12"
    },
    {
      "id": 2100,
      "log": "DriverFrameworks",
      "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
      "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
      "level": "Information",
      "title": "Device connection attempt initiated",
      "summary": "The driver framework is initiating a connection with a device instance.",
      "details": "Generated when the user-mode driver framework (UMDF) begins establishing a connection to a device instance. This event is part of the same connection sequence as EID 2003 and 2004, providing an additional timestamp reference for when driver-level communication with the device began.",
      "category": "USB Device",
      "tags": [
        "usb",
        "removable-media",
        "physical-access"
      ],
      "relatedEventIds": [
        {
          "id": 2003,
          "log": "DriverFrameworks"
        },
        {
          "id": 2004,
          "log": "DriverFrameworks"
        },
        {
          "id": 2101,
          "log": "DriverFrameworks"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1091",
          "techniqueName": "Replication Through Removable Media",
          "tactics": [
            {
              "tacticId": "TA0001",
              "tacticName": "Initial Access"
            },
            {
              "tacticId": "TA0008",
              "tacticName": "Lateral Movement"
            }
          ]
        },
        {
          "techniqueId": "T1052.001",
          "techniqueName": "Exfiltration Over Physical Medium: Exfiltration over USB",
          "tactics": [
            {
              "tacticId": "TA0010",
              "tacticName": "Exfiltration"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Use the timestamp alongside EID 2003 and 2004 to establish precise device connection timing",
          "Correlate device connection timing with file access or copy events to detect data exfiltration to removable media"
        ],
        "commonFalsePositives": [
          "Any legitimate USB device connection"
        ]
      },
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows-hardware/drivers/wdf/user-mode-driver-framework-design-guide"
      },
      "volumeIndicator": "medium",
      "windowsVersions": {
        "minVersion": "Windows 8 / Server 2012"
      },
      "keyFields": [
        {
          "name": "DeviceInstanceId",
          "xpath": "EventData/Data[@Name='DeviceInstanceId']",
          "description": "Device instance identifier for the device being connected"
        }
      ],
      "lastReviewed": "2026-04-12"
    },
    {
      "id": 2101,
      "log": "DriverFrameworks",
      "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
      "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
      "level": "Information",
      "title": "Device connection established",
      "summary": "The driver framework successfully established a connection with the device.",
      "details": "Generated when the user-mode driver framework (UMDF) successfully completes connection to a device instance. This confirms the device is fully operational and ready for use — for USB storage devices, this is the point at which the volume becomes accessible to the file system.",
      "category": "USB Device",
      "tags": [
        "usb",
        "removable-media",
        "physical-access",
        "insider-threat"
      ],
      "relatedEventIds": [
        {
          "id": 2003,
          "log": "DriverFrameworks"
        },
        {
          "id": 2004,
          "log": "DriverFrameworks"
        },
        {
          "id": 2100,
          "log": "DriverFrameworks"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1091",
          "techniqueName": "Replication Through Removable Media",
          "tactics": [
            {
              "tacticId": "TA0001",
              "tacticName": "Initial Access"
            },
            {
              "tacticId": "TA0008",
              "tacticName": "Lateral Movement"
            }
          ]
        },
        {
          "techniqueId": "T1052.001",
          "techniqueName": "Exfiltration Over Physical Medium: Exfiltration over USB",
          "tactics": [
            {
              "tacticId": "TA0010",
              "tacticName": "Exfiltration"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "For USB storage, this event marks when the volume became accessible — correlate with file copy events immediately following this timestamp",
          "Correlate with Security EID 4663 (object access) on removable drive paths to identify what files were accessed or copied",
          "Device connection near the end of an employee's last working day is a common insider threat indicator",
          "Correlate with EID 2100 to measure driver initialization time"
        ],
        "commonFalsePositives": [
          "Any routine USB device connection completing initialization"
        ]
      },
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows-hardware/drivers/wdf/user-mode-driver-framework-design-guide"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows 8 / Server 2012"
      },
      "keyFields": [
        {
          "name": "DeviceInstanceId",
          "xpath": "EventData/Data[@Name='DeviceInstanceId']",
          "description": "Device instance identifier for the fully connected device"
        }
      ],
      "lastReviewed": "2026-04-12"
    }
  ]
}