All, Over a period of 42 seconds tonight my Security Log shows events: 6416 - new USB device recognized (HID compliant mouse) - twice 4624/4672 - SYSTEM/advapi logging on "myhostname$" and assigning a looong list of privileges 4624/4672 - SYSTEM/advapi logging on "myhostname$" and assigning a looong list of privileges again 5379 - SYSTEM/"myhostname$" enumerating credentials - 193 times !! This is a Windows 11 minitower, patched up to date from Microsoft. I noticed it because I was gaming, and my mouse was lagging. It looks to me like something connected as a USB mouse, logged in, and read every credential on my machine. Can anyone help me understand what might be going on, and/or what other information would help to explain what's happening? Thanks!

Suspicious activity in Security Log - requesting a review

user1 user1 0

All,

Over a period of 42 seconds tonight my Security Log shows events:

6416 - new USB device recognized (HID compliant mouse) - twice
4624/4672 - SYSTEM/advapi logging on "myhostname$" and assigning a looong list of privileges
4624/4672 - SYSTEM/advapi logging on "myhostname$" and assigning a looong list of privileges again
5379 - SYSTEM/"myhostname$" enumerating credentials - 193 times !!

This is a Windows 11 minitower, patched up to date from Microsoft. I noticed it because I was gaming, and my mouse was lagging.

It looks to me like something connected as a USB mouse, logged in, and read every credential on my machine.

Can anyone help me understand what might be going on, and/or what other information would help to explain what's happening?

Thanks!