← All cheat sheets

USB DEVICE CONTROL

Plain-text reference · 9 KB. Read it, search it (Ctrl-F) or print it.

Decide which USB devices a computer accepts, and see which ones were
connected: Windows Device Installation Restrictions (Group Policy),
Plug and Play audit events, pnputil and Get-PnpDevice; on Linux the
kernel's USB authorization switches and USBGuard. Related ATT&CK
techniques: T1200 Hardware Additions, T1091 Replication Through
Removable Media. To check a device list, use the USB Hygiene Helper tool.

WHY IDS ARE NOT PROOF#

# A device reports its own vendor ID and product ID (idVendor/idProduct
# in its device descriptor). Anyone with a device gadget kit can fake
# descriptors, so an allow list by VID:PID or name is not authentication.
# Prefer rules that also check the interfaces a device offers, the port,
# or (USBGuard) a hash of its descriptors.
# Windows hardware ID:   USB\VID_v(4)&PID_d(4)&REV_r(4)
# One interface of a composite device:   USB\VID_v(4)&PID_d(4)&MI_z(2)

WINDOWS: SEE WHAT IS AND WAS CONNECTED#

pnputil /enum-devices /connected           # Windows 10 1903+
pnputil /enum-devices /disconnected        # known but not connected now
pnputil /enum-devices /class "DiskDrive"   # one device class
pnputil /enum-devices /connected /deviceids   # + hardware/compatible IDs
#   /deviceids needs Windows 11 21H2 or later
Get-PnpDevice -PresentOnly -Class DiskDrive, HIDClass, Keyboard, Mouse
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match '^(USB|HID|USBSTOR)\\' } | Select-Object Status, Class, FriendlyName, InstanceId | Export-Csv -Path usb-devices.csv -NoTypeInformation
# The CSV can be checked in the USB Hygiene Helper (input + storage on
# one device, vendor IDs not in usb.ids).

WINDOWS: BLOCK OR ALLOW DEVICE INSTALLATION (GPO)#

Computer Configuration > Administrative Templates > System >
  Device Installation > Device Installation Restrictions
# Computer policy: applies to every user who logs on. Microsoft's guide
# covers Windows 10 1809 and later.
Prevent installation of devices that match any of these device IDs
Prevent installation of devices that match any of these device
  instance IDs
Prevent installation of devices using drivers that match these
  device setup classes                    # setup class GUIDs
Prevent installation of devices not described by other policy settings
Allow installation of devices that match any of these device IDs
Allow installation of devices that match any of these device instance IDs
Allow installation of devices using drivers that match these device
  setup classes
Allow administrators to override Device Installation Restriction policies
# By default every "Prevent installation..." setting wins over any
# "Allow" setting. The Allow settings are meant to be used with
# "Prevent installation of devices not described by other policy settings".
Apply layered order of evaluation for Allow and Prevent device
  installation policies across all device match criteria
# Enabled: the more specific match wins, in this order:
#   Device instance IDs > Device IDs > Device setup class > Removable devices
# Microsoft recommends enabling it in most practical applications.
# Every Prevent setting has the option "also apply to matching devices
# that are already installed" (blocks devices installed before the GPO).
# Find the IDs and class GUID: Device Manager > device > Details, or
pnputil /enum-devices /connected /deviceids

WINDOWS: AUDIT EVENTS (SECURITY LOG)#

auditpol /set /subcategory:"{0CCE9248-69AE-11D9-BED3-505054503030}" /success:enable
#   Audit PNP Activity (no Failure events in this subcategory)
auditpol /set /subcategory:"{0CCE9245-69AE-11D9-BED3-505054503030}" /success:enable /failure:enable
#   Audit Removable Storage: file access on removable storage, 4656/4658/4663
6416   A new external device was recognized by the System
6419   A request was made to disable a device
6420   A device was disabled
6421   A request was made to enable a device
6422   A device was enabled
6423   The installation of this device is forbidden by system policy
6424   The installation of this device was allowed, after having
       previously been forbidden by policy
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=6416,6423} -MaxEvents 50
# 6416 fields: DeviceId (instance path), DeviceDescription, ClassName,
# ClassId, VendorIds (hardware IDs), CompatibleIds, LocationInformation.
# 6416 is usually logged by SYSTEM: Microsoft suggests reporting it when
# Subject\Security ID is not SYSTEM.

WINDOWS: DISABLE OR REMOVE ONE DEVICE#

pnputil /disable-device "<instance ID>"     # Windows 10 2004+
pnputil /remove-device "<instance ID>"      # Windows 10 2004+
pnputil /enable-device "<instance ID>"
# To stop a device being installed at all, use the Prevent policies above.

LINUX: KERNEL USB AUTHORIZATION (SYSFS)#

lsusb                                      # IDs and names
lsusb -t                                   # device hierarchy as a tree
echo 0 > /sys/bus/usb/devices/usbX/authorized_default   # lock down hostX
echo 1 > /sys/bus/usb/devices/usbX/authorized_default   # remove lock down
echo 2 > /sys/bus/usb/devices/usbX/authorized_default   # internal ports only
echo 1 > /sys/bus/usb/devices/DEVICE/authorized         # authorize one
echo 0 > /sys/bus/usb/devices/DEVICE/authorized         # de-authorize
echo 0 > /sys/bus/usb/devices/INTERFACE/authorized      # one interface
echo 0 > /sys/bus/usb/devices/usbX/interface_authorized_default  # deny new
# Run as root. By default all USB devices and interfaces are authorized.
# After authorizing an interface, trigger probing by writing INTERFACE
# to /sys/bus/usb/drivers_probe.

LINUX: USBGUARD#

sudo usbguard generate-policy > rules.conf    # allow what is plugged in
vi rules.conf                                 # review/modify the rules
sudo install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf
sudo systemctl restart usbguard
sudo usbguard list-devices                  # -b blocked, -a allowed, -t tree
sudo usbguard allow-device 10               # 10 = number from list-devices
sudo usbguard allow-device -p 10            # and append a permanent rule
sudo usbguard block-device 10               # deauthorize
sudo usbguard reject-device 10              # deauthorize and remove
sudo usbguard list-rules
sudo usbguard watch                         # print events as they happen
# The CLI talks to the daemon over IPC; IPCAllowedUsers defaults to root.
# generate-policy adds via-port for devices without a serial number;
# -X: no hash attribute, -H: hash-only policy, -t block: catch-all rule.
# /etc/usbguard/usbguard-daemon.conf (defaults):
#   ImplicitPolicyTarget=block       devices that match no rule
#   PresentDevicePolicy=apply-policy devices present when the daemon starts
#   InsertedDevicePolicy=apply-policy  devices connected after it starts
#   AuditBackend=FileAudit
#   AuditFilePath=%localstatedir%/log/usbguard/usbguard-audit.log

USBGUARD RULES (rules.conf)#

# rule = target [vid:pid] [attributes] [conditions], first match wins;
# target is allow, block or reject. Interface type = cc:ss:pp (hex).
allow with-interface equals { 08:*:* }      # storage-only devices
reject with-interface all-of { 08:*:* 03:00:* }   # storage + HID
reject with-interface all-of { 08:*:* 03:01:* }   # storage + boot HID
reject with-interface all-of { 08:*:* e0:*:* }    # storage + wireless
reject with-interface all-of { 08:*:* 02:*:* }    # storage + CDC comms
allow 1050:0011 name "Yubico Yubikey II" serial "0001234567" via-port "1-2"
reject via-port "1-2"                       # nothing else on that port
allow with-interface one-of { 03:00:01 03:01:01 } if !allowed-matches(with-interface one-of { 03:00:01 03:01:01 })
#   a keyboard only if no keyboard is allowed already
# Operators: all-of, one-of, none-of, equals, equals-ordered.
# Class codes (USB-IF): 02 CDC, 03 HID, 08 Mass Storage, 09 Hub,
# e0 Wireless Controller, ff Vendor Specific.
# USBGuard docs: a deny list of "bad" devices is the wrong approach on
# its own; keep blocking as the implicit default.

SOURCES#

Microsoft Learn: Manage device installation with Group Policy; Standard
USB identifiers; PnPUtil command syntax and examples; Get-PnpDevice;
Audit PNP Activity; Audit Removable Storage; event 6416; MS-GPAC 2.2.1.2
(subcategory GUIDs). Linux kernel docs: Authorizing (or not) your USB
devices. USBGuard: rule language, usbguard(1), usbguard-daemon.conf(5).
USB-IF Defined Class Codes. MITRE ATT&CK T1200, T1091.

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.