Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10 detections
Filters
Last updated
All Time
Detection languages
8
2
Contributors
5
4
1
Categories
6
4
4
3
2
Platforms
8
2
Products / Services
4
2
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Detects command and control communications via files on removable media
This rule detects potential air-gap bridging activity via removable media. Specifically, it looks for SMB traffic on port 445 containing the string "USBSTOR" (case-insensitive) and the file extension ".bin" (case-insensitive). This combination suggests a file transfer related to USB storage, possibly a firmware update or a malicious payload, being moved across a network segment, potentially bypassing an air-gapped system.
Detects command and control communications via files on removable media
This rule detects potential command and control (C2) activity where commands are being read from a removable media share over SMB. It specifically looks for SMB traffic containing the string "USBSTOR" (case-insensitive) and ".txt" (case-insensitive), indicating access to text files on a USB storage device. A threshold of 5 occurrences within 30 seconds from the same source IP is applied to reduce false positives.
Detects the creation of files within hidden folders on removable media that are designed to mimic the Windows Recycle Bin ($RECYCLE.BIN or $RECYCLE.BIN.USER). This technique is used by APT37's THUMBSBD and VIRUSTASK malware to stage malicious files (.rb, .dat) for bridging air-gapped networks.
Check all created files.
That does not have extension ps1, bat or cmd to avoid IT Pro scripts.
That are not copied to C:\ to detect all file share, external drive, data partition that are not allowed, etc.
This could help to detect malicious insider/user that has unencrypted data partition and that are using it to exfiltrate data even while removable devices & cloud storage is blocked.
That does not have extension ps1, bat or cmd to avoid IT Pro scripts.
That are not copied to C:\ to detect all file share, external drive, data partition that are not allowed, etc.
This could help to detect malicious insider/user that has unencrypted data partition and that are using it to exfiltrate data even while removable devices & cloud storage is blocked.
This query make a best-guess detection regarding which removable media device caused an AV detection.
The query is best run over 30 days to get the full USB history.
Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device.
The query is best run over 30 days to get the full USB history.
Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device.
Action "PnpDeviceConnected" reports the connection of any plug and play device.
Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416.
Query #1: look for rare one-time devices connected to a specific machine.
Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416.
Query #1: look for rare one-time devices connected to a specific machine.
Action "PnpDeviceConnected" reports the connection of any plug and play device.
Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416.
Query #1: look for rare one-time devices connected to a specific machine.
Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416.
Query #1: look for rare one-time devices connected to a specific machine.
Show usb mounted devices and drive letters