USB Device Enumeration via Web Shell

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•6

This rule detects attempts to enumerate USB devices on a system via a web shell. It specifically looks for HTTP URI requests containing 'wmic' and 'path Win32_USBHub', which are commands used to query USB device information using Windows Management Instrumentation (WMI). The 'nocase' modifier indicates that the content matching is case-insensitive.