Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
15 detections
Filters
Last updated
All Time
Detection languages
14
1
Contributors
5
4
3
1
1
Categories
13
9
3
2
2
Platforms
12
2
1
Products / Services
12
1
1
1
1
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects when a USB mass storage device is connected to a host and is followed shortly thereafter by a large volume of file creations or modifications on a removable drive, which may indicate data exfiltration or staging.
Detects a high volume of file creation events (greater than 200 files) on an external USB mount session by a non-system account, which may indicate potential data exfiltration or staging to removable media.
This rule detects a high volume of file creation or modification events on removable media (e.g., USB drives). A count of 10 or more file operations within a one-hour window by a single initiating process account on paths containing 'USB' or 'Removable' is considered suspicious and may indicate data exfiltration or staging.
This rule detects when a single process account creates or copies 10 or more files to a removable media device (e.g., USB drive) within a one-hour window. This behavior can be indicative of data exfiltration attempts.
This rule detects a high volume of file creation or modification events on removable media (e.g., USB drives). A count of 10 or more file operations within a one-hour window by a single initiating process account on paths containing 'USB' or 'Removable' is considered suspicious and may indicate data exfiltration or staging.
This rule detects when a single process account creates or copies 10 or more files to a removable media device (e.g., USB drive) within a one-hour window. This behavior can be indicative of data exfiltration attempts.
This rule detects large data transfers (over 65000 bytes) to a Server Message Block (SMB) share that contains the string "USBSTOR" in its content. This combination suggests data exfiltration to removable media, as "USBSTOR" is often associated with USB storage devices. The rule uses a threshold of 20 such transfers within 60 seconds from the same source IP to trigger an alert, indicating a sustained large data transfer activity.
This rule detects when a single process account creates or copies 10 or more files to a removable media device (e.g., USB drive) within a one-hour window. This behavior can be indicative of data exfiltration attempts.
KQL Query
KQL Query from file: Check for Entra Legacy TLS Login
KQL Query from file: Check for Azure Outdated Security Protocols
This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations. But be aware that Advanced Hunting is not monitoring all the file types.
'This query looks for any mass download by a single user with possible file copy activity to a new USB drive. Malicious insiders may perform such activities that may cause harm to the organization.
This query could also reveal unintentional insider that had no intention of malicious activity but their actions may impact an organizations security posture.
Reference:https://docs.microsoft.com/defender-cloud-apps/policy-template-reference'
This query could also reveal unintentional insider that had no intention of malicious activity but their actions may impact an organizations security posture.
Reference:https://docs.microsoft.com/defender-cloud-apps/policy-template-reference'
This query searches for file copies which occur within a period of time (by default 15 min) to volumes other than the C drive or UNC shares. By default, this query will
search all devices. A single device can be specified by entering the DeviceName in the DeviceNameToSearch variable. Additionally, to change the period of time from when
the USB device was inserted, adjust the TimespanInSeconds value.
Happy hunting!
search all devices. A single device can be specified by entering the DeviceName in the DeviceNameToSearch variable. Additionally, to change the period of time from when
the USB device was inserted, adjust the TimespanInSeconds value.
Happy hunting!
Intent:
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.