Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
76 detections
Filters
Last updated
All Time
Detection languages
33
13
11
5
4
Contributors
23
13
7
7
6
Categories
45
38
14
12
10
Platforms
72
4
Products / Services
39
18
5
4
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
4
IDS Protocols
2
1
1
Detects the creation of a malicious executable named 'My Pictures.exe' on a removable drive, a technique used by VenomRAT for lateral movement.
Analytic detect abnormal pattern of command and scripting interpreter followed by USB mount
This detection identifies when a file is created or modified on a host within a short time window after a USB storage device was inserted. This behavior can be indicative of malware spreading via removable media, where a payload is automatically dropped onto the system.
This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations. But be aware that Advanced Hunting is not monitoring all the file types.
Detects external disk drives or plugged-in USB devices.
Check all created files.
That does not have extension ps1, bat or cmd to avoid IT Pro scripts.
That are not copied to C:\ to detect all file share, external drive, data partition that are not allowed, etc.
This could help to detect malicious insider/user that has unencrypted data partition and that are using it to exfiltrate data even while removable devices & cloud storage is blocked.
That does not have extension ps1, bat or cmd to avoid IT Pro scripts.
That are not copied to C:\ to detect all file share, external drive, data partition that are not allowed, etc.
This could help to detect malicious insider/user that has unencrypted data partition and that are using it to exfiltrate data even while removable devices & cloud storage is blocked.
This query make a best-guess detection regarding which removable media device caused an AV detection.
The query is best run over 30 days to get the full USB history.
Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device.
The query is best run over 30 days to get the full USB history.
Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device.
Action "PnpDeviceConnected" reports the connection of any plug and play device.
Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416.
Query #1: look for rare one-time devices connected to a specific machine.
Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416.
Query #1: look for rare one-time devices connected to a specific machine.
Action "PnpDeviceConnected" reports the connection of any plug and play device.
Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416.
Query #1: look for rare one-time devices connected to a specific machine.
Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416.
Query #1: look for rare one-time devices connected to a specific machine.
Show usb mounted and files copied
Show usb mounted devices and drive letters
This rule detects when an external disk drive or a USB mass storage device is recognized by the system. It specifically looks for Windows Security Event ID 6416, which indicates that a new external device was recognized, and further filters for devices classified as 'DiskDrive' or with the description 'USB Mass Storage Device'. This can be an indicator of initial access, data exfiltration, or the introduction of malicious software via removable media.
Detects external disk drives or plugged-in USB devices.
Page 4 of 4