USB Hygiene Helper
Paste the USB device list of a computer and see which devices need a closer look.
1. Get the device list
Run one of these on the computer you want to check, then paste the output below or load the file.
Linux (both commands, paste the whole output)
lsusb; lsusb -tlsusb -t lists each device's interfaces (keyboard, storage…); without it the input + storage check cannot run.
Windows PowerShell (saves usb-devices.csv, load it with the button below)
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match '^(USB|HID|USBSTOR)\\' } | Select-Object Status, Class, FriendlyName, InstanceId | Export-Csv -Path usb-devices.csv -NoTypeInformation-PresentOnly keeps only devices attached now. The plain table view of Get-PnpDevice cuts long instance IDs with "...", which hides the vendor ID.
Windows Command Prompt (Windows 10 version 1903 or later, English output)
pnputil /enum-devices /connected2. Paste and check
Accepted: lsusb, lsusb -t, Get-PnpDevice (CSV export or table), pnputil /enum-devices, or a CSV with VID and PID columns. Up to 5 MB.
3. Result
| Interfaces / Windows class |
|---|
What the flags mean
Vendor and product IDs prove nothing on their own. Windows builds a device's ID (USB\VID_xxxx&PID_xxxx) from the idVendor and idProduct fields that the device itself reports in its device descriptor, so a device can claim any vendor. A known vendor name is not a clean bill of health, and an unknown one is not proof of an attack.
What to do with a flagged device
- Find the physical device and confirm with its owner that it is expected.
- Restrict which devices can be installed: MITRE ATT&CK mitigation M1034 "Limit Hardware Installation" (block unknown devices and accessories by endpoint configuration). On Windows this is done with the device installation policies described in Microsoft's "Manage Device Installation with Group Policy".
Sources
- Microsoft Learn: Standard USB identifiers (VID/PID/MI in Windows IDs)
- Microsoft Learn: System-defined device setup classes (Windows class names)
- Microsoft Learn: Get-PnpDevice and PnPUtil command syntax
- USB-IF: Defined Class Codes (HID 03h, Mass Storage 08h, Hub 09h…)
- The USB ID Repository (usb.ids), version …, used under the BSD-3-Clause licence
- MITRE ATT&CK T1200 Hardware Additions
- Microsoft Learn: Manage Device Installation with Group Policy