Bulk File Copy to USB Drive via SMB

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects bulk file copies to USB drives via SMB by looking for the string "USBSTOR" (case-insensitive) within SMB traffic on port 445. A threshold of 100 occurrences within 60 seconds from the same source IP triggers the alert, indicating a potential exfiltration attempt.