Tracking USB Data Transfers with Microsoft Defender
Visibility into how much data is being copied to USB devices in your environment? Here’s a KQL query that correlates USB mount events with file creation activity to identify potential data exfiltration. 👉 What this query does: 1. Detects when a USB drive is mounted 2. Correlates it with file creation events on removable media 3. Calculates the total data transferred per user 4. Highlights the Top 5 users by data volume 5. Visualizes the result as a pie chart for quick insights 🕵🏻♀️This is especially useful for: 1. Insider risk investigations 2. DLP and data exfiltration monitoring 3. Threat hunting scenarios 💡 Pro tip: If you remove the last three lines (the summarize, top, and render piechart), the query becomes compatible with a Custom Detection Rule in Microsoft Defender. 🔑That means you can: 1. Trigger alerts automatically 2. Enable remediation actions (like isolating a device or initiating investigation)
Microsoft Sentinel (KQL)
