Suspicious USB NIC (MITM Implant) Detected
This rule detects the connection of USB network interface cards (NICs) that are known to be used in Man-in-the-Middle (MITM) implants or other malicious hardware additions. It specifically looks for devices with Vendor IDs and Product IDs associated with suspicious chipsets like ASIX AX88772A (Hak5 LAN Turtle), ASIX AX88179, Realtek USB GbE (Pi-based dongles/implants), Realtek 10/100 USB Ethernet, and D-Link USB Ethernet (modded implants).
Microsoft Sentinel (KQL)
