USB and Peripheral Device List Enumerated via Web Shell

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects attempts to enumerate USB and peripheral devices on a Windows system via a web shell. It specifically looks for HTTP requests containing 'wmic' and 'Win32_USBHub' in the URI, indicating a WMI query to list USB devices. This activity is often associated with discovery tactics by attackers who have gained initial access to a system.