Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
14
3
3
3
3
Contributors
9
5
3
3
2
Categories
11
7
6
6
5
Platforms
23
3
1
Products / Services
9
8
4
4
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
3
IDS Protocols
1
1
1
Detects execution of xcopy with specific flags intended to perform recursive copying of files, including hidden and system files, into a staging directory located within C:\Users\Public\. This behavior matches the known exfiltration collection routine of the NarwhalRAT malware, often invoked by processes such as python.exe or userscreen.exe.
This rule detects the execution of RUSTYMOVE, a tool associated with the Transparent Tribe (APT36) threat group, which is used for propagation via removable media. It monitors for the specific executable 'Automata-20.exe', the presence of specific task-related command line arguments, the dropping of suspicious file paths, and PowerShell-based enumeration of connected USB/removable drives.
Detects the use of PowerShell to enumerate storage devices (USB, disk, partition information) and perform file operations such as copying or logging, potentially indicating malicious data collection from removable media or external drives.
Detects high-volume file writes or the use of common command-line copy utilities (xcopy, robocopy, copy) targeting removable drive paths (E-G:). This behavior is often indicative of data staging or exfiltration activities.
Detects high-volume file writes or the use of common command-line copy utilities (xcopy, robocopy, copy) targeting removable drive paths (E-G:). This behavior is often indicative of data staging or exfiltration activities.
Detects the specific xcopy command-line arguments used by APT37 NarwhalRAT to silently copy data from removable drives to a local temporary path. This rule looks for the combination of '/s', '/e', '/y', '/c', '/q', '/h', and '/b' flags used with xcopy.exe, which is indicative of the malware's data staging behavior.
Detects the specific xcopy command-line arguments used by APT37 NarwhalRAT to silently copy data from removable drives to a local temporary path. This rule identifies the use of xcopy.exe with a combination of flags (/s, /e, /y, /c, /q, /h, /b) that are characteristic of NarwhalRAT's data staging activities from removable media.
Detects large data transfers to removable storage media for physical exfiltration
Detects bulk file reading from removable media shares for data collection
This rule detects potential data exfiltration or unauthorized copying of data from USB drives via an SSH SCP session. It specifically looks for TCP traffic on port 22 (SSH) within the home network, where the data flow is from the client to the server (upload). The rule triggers if the content of the SCP session includes both "/media/" and "/usb" (case-insensitive), indicating paths commonly associated with mounted USB devices on Linux systems, and the data size is greater than 1000 bytes. This suggests that contents from a USB drive are being copied off the system over SSH.
This rule detects potential data exfiltration of removable media file contents over HTTP. It specifically looks for HTTP POST requests to a URI containing "upload" with a payload size greater than 50,000 bytes. A threshold is applied to prevent excessive alerts, triggering if 5 such events occur from the same source within 60 seconds.
This rule detects a high volume of file read operations from a network share that contains the string "USBSTOR" in its content, indicating potential access to removable media. It triggers an alert if more than 50 such events occur within a 30-second window from the same source IP address. This could signify an attempt to exfiltrate data from a removable device shared over the network.
Detects PowerShell script execution utilizing WMI event subscription (Register-WmiEvent) explicitly targeting the creation of logical disks with DriveType 2 (USB drives). This technique is known to be used by the GammaSteel threat group to monitor and potentially steal data from physical media.
Detects PowerShell script execution utilizing WMI event subscription (Register-WmiEvent) explicitly targeting the creation of logical disks with DriveType 2 (USB drives), a technique GammaSteel uses to steal data from physical media.
This analytic is used to identify when a removable media device is attached to a machine and then a process is executed from the same drive letter assigned to the removable media device. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
This rule identifies when a USB removable media device is attached to a Windows host by monitoring modifications to the HKLM\System\CurrentControlSet\Enum\USBSTOR\ registry key. Adversaries and insider threats may use removable media devices for various malicious activities, including initial access, execution, and data exfiltration.
This analytic is used to identify when a USB removable media device is attached to a Windows host. It queries the Endpoint Registry data model to look for modifications to the Windows Portable Device keys HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations. But be aware that Advanced Hunting is not monitoring all the file types.
Check all created files.
That does not have extension ps1, bat or cmd to avoid IT Pro scripts.
That are not copied to C:\ to detect all file share, external drive, data partition that are not allowed, etc.
This could help to detect malicious insider/user that has unencrypted data partition and that are using it to exfiltrate data even while removable devices & cloud storage is blocked.
That does not have extension ps1, bat or cmd to avoid IT Pro scripts.
That are not copied to C:\ to detect all file share, external drive, data partition that are not allowed, etc.
This could help to detect malicious insider/user that has unencrypted data partition and that are using it to exfiltrate data even while removable devices & cloud storage is blocked.
This query can be used to explore any instances where a terminated individual (i.e. one who has an impending termination date but has not left the company) downloads a large number of files from a non-Domain network address.
This query make a best-guess detection regarding which removable media device caused an AV detection.
The query is best run over 30 days to get the full USB history.
Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device.
The query is best run over 30 days to get the full USB history.
Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device.
Page 1 of 2