Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20 detections
Filters
Last updated
All Time
Detection languages
10
5
2
1
1
Contributors
4
4
3
3
2
Categories
9
7
6
6
3
Platforms
19
1
Products / Services
5
4
3
2
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
1
1
IDS Protocols
2
Detects the use of PowerShell commands (Get-Volume, Get-Partition, Get-Disk) to identify and inspect information about connected removable storage media such as USB, IEEE 1394, SD, or MMC devices. This behavior is indicative of an adversary enumerating potential targets for data staging or exfiltration.
Detects the execution of wmic.exe with specific WMI queries (Win32_ComputerSystem, Win32_PhysicalMedia, Win32_PnPEntity) commonly used for system profiling and hardware discovery by threat actors like TA4922. The rule assigns a higher risk score when the process is launched from potentially suspicious locations such as user-writable or temporary directories.
This rule detects the exfiltration of peripheral device information over HTTP POST requests. It specifically looks for HTTP POST requests with a body size greater than 200 bytes that contain the string "DeviceID" (case-insensitive). This pattern is indicative of malware or malicious scripts attempting to send device identifiers or other system information to a remote server.
This rule detects attempts to enumerate USB and peripheral devices on a Windows system via a web shell. It specifically looks for HTTP requests containing 'wmic' and 'Win32_USBHub' in the URI, indicating a WMI query to list USB devices. This activity is often associated with discovery tactics by attackers who have gained initial access to a system.
WMI Drive Discovery By MediaType
Cortex XDR
Detects a specific WMI query used by GammaWorm to find network drives and low-cost USB drives for malware propagation by filtering for mediatype=null. This query targets 'win32_logicaldisk' and specifically looks for drives where 'mediatype=null', which can indicate network or removable drives.
Detects enumeration of USB devices for peripheral device discovery
Detects PowerShell script execution utilizing WMI event subscription (Register-WmiEvent) explicitly targeting the creation of logical disks with DriveType 2 (USB drives). This technique is known to be used by the GammaSteel threat group to monitor and potentially steal data from physical media.
Detects PowerShell script execution utilizing WMI event subscription (Register-WmiEvent) explicitly targeting the creation of logical disks with DriveType 2 (USB drives), a technique GammaSteel uses to steal data from physical media.
Detects WMI queries targeting the win32_logicaldisk class and filtering for mediatype=null. This specific query is used by Gamaredon's GammaWorm to identify network drives and removable drives (such as USBs) for malware propagation.
Detects a specific WMI query used by malware, such as Gamaredon's GammaWorm, to discover network drives (e.g., SMB mounts) and low-cost USB drives for malware propagation by filtering for mediatype=null.
KQL Query
Attackers may leverage fsutil to enumerated connected drives.
Attackers may leverage fsutil to enumerated connected drives.
Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.
Action "PnpDeviceConnected" reports the connection of any plug and play device.
Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416.
Query #1: look for rare one-time devices connected to a specific machine.
Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416.
Query #1: look for rare one-time devices connected to a specific machine.
This query searches for not onboarded devices with a specific Suffix
This rule detects PowerShell script block text containing "Win32_PnPEntity". This WMI class is used to query information about Plug and Play devices, which can include peripheral devices. Adversaries may use this to gather information about attached peripheral devices and components connected to a computer system for discovery purposes.
This rule detects the execution of 'fsutil.exe' with the 'drives' command-line argument. This command is used to enumerate connected drives on a Windows system. Adversaries, such as Turla, have been observed using this technique for discovery purposes to gain information about the system's environment.
Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.
Attackers may leverage fsutil to enumerated connected drives.