analyzing-usb-device-connection-history

name	analyzing-usb-device-connection-history
description	Investigate USB device connection history from Windows registry, event logs, and setupapi logs to track removable media usage and potential data exfiltration. Use when working with analyzing usb device connection history.
domain	cybersecurity
tags	["forensics","usb-forensics","removable-media","registry-analysis","data-exfiltration","device-history"]
subdomain	digital-forensics
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

Analyzing Usb Device Connection History

Overview

Cybersecurity skill for analyzing usb device connection history. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "analyzing usb device connection history"

• "Investigate USB device connection history from Windows registry, event logs, and"

• When investigating potential data exfiltration via removable storage devices

• During insider threat investigations to track USB device usage

• For compliance audits verifying removable media policy enforcement

• When correlating USB connections with file access and copy events

• For establishing a timeline of device connections during an incident

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Forensic image or extracted registry hives and event logs
• Access to SYSTEM, SOFTWARE, and NTUSER.DAT registry hives
• SetupAPI logs (setupapi.dev.log)
• Windows Event Logs (System, Security, DriverFrameworks-UserMode)
• USBDeview, USB Forensic Tracker, or RegRipper
• Understanding of USB device identification (VID, PID, serial number)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}