• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Files copied to USB drives

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•5•0•133

    This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations. But be aware that Advanced Hunting is not monitoring all the file types.

    Microsoft Sentinel (KQL)

    Tags

    TA0010 - ExfiltrationT1091 - Replication Through Removable MediaT1025 - Data from Removable MediaTA0008 - Lateral MovementTA0001 - Initial AccessTA0009 - CollectionT1052 - Exfiltration Over Physical MediumT1052.001 - Exfiltration over USBData ExfiltrationFile CreationWindowsWindows Defender Atpkqltactic:Exfiltration

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?