Splunk Search

Trying to monitor HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR but nothing is happening

bosburn_splunk
Splunk Employee
Splunk Employee

The following set up was used in regmon-filters.conf:

[WinRegistry]
proc = C:\\.*
baseline = 0
disabled = 0
hive = HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR\\?.*
index = default
type = rename|close|set|delete|open|create|query

When adding a USB drive, I see nothing being reported on. What is going on?

0 Karma
1 Solution

bosburn_splunk
Splunk Employee
Splunk Employee

This is a known issue - SPL-58682 - with Splunk monitoring the Current Control Set for this section. The work around is to use the following setting for hive:

hive = HKEY_LOCAL_MACHINE\\SYSTEM\\*CONTROLSET*\\ENUM\\USBSTOR?.*

This will monitor all control sets for changes for that path.

Brian

View solution in original post

0 Karma

bosburn_splunk
Splunk Employee
Splunk Employee

This is a known issue - SPL-58682 - with Splunk monitoring the Current Control Set for this section. The work around is to use the following setting for hive:

hive = HKEY_LOCAL_MACHINE\\SYSTEM\\*CONTROLSET*\\ENUM\\USBSTOR?.*

This will monitor all control sets for changes for that path.

Brian

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...