Trying to monitor HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR but nothing is happening

[bosburn_splunk]

The following set up was used in regmon-filters.conf:

[WinRegistry]
proc = C:\\.*
baseline = 0
disabled = 0
hive = HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR\\?.*
index = default
type = rename|close|set|delete|open|create|query

When adding a USB drive, I see nothing being reported on. What is going on?

[bosburn_splunk · Accepted solution]

This is a known issue - SPL-58682 - with Splunk monitoring the Current Control Set for this section. The work around is to use the following setting for hive:

hive = HKEY_LOCAL_MACHINE\\SYSTEM\\*CONTROLSET*\\ENUM\\USBSTOR?.*

This will monitor all control sets for changes for that path.

Brian