Shital Khatri
@ShitalKhatri0 followers6 downloads110 copies5 likes527 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
Platforms
1
Visibility into how much data is being copied to USB devices in your environment? Here’s a KQL query that correlates USB mount events with file creation activity to identify potential data exfiltration.
👉 What this query does:
1. Detects when a USB drive is mounted
2. Correlates it with file creation events on removable media
3. Calculates the total data transferred per user
4. Highlights the Top 5 users by data volume
5. Visualizes the result as a pie chart for quick insights
🕵🏻♀️This is especially useful for:
1. Insider risk investigations
2. DLP and data exfiltration monitoring
3. Threat hunting scenarios
💡 Pro tip:
If you remove the last three lines (the summarize, top, and render piechart), the query becomes compatible with a Custom Detection Rule in Microsoft Defender.
🔑That means you can:
1. Trigger alerts automatically
2. Enable remediation actions (like isolating a device or initiating investigation)
👉 What this query does:
1. Detects when a USB drive is mounted
2. Correlates it with file creation events on removable media
3. Calculates the total data transferred per user
4. Highlights the Top 5 users by data volume
5. Visualizes the result as a pie chart for quick insights
🕵🏻♀️This is especially useful for:
1. Insider risk investigations
2. DLP and data exfiltration monitoring
3. Threat hunting scenarios
💡 Pro tip:
If you remove the last three lines (the summarize, top, and render piechart), the query becomes compatible with a Custom Detection Rule in Microsoft Defender.
🔑That means you can:
1. Trigger alerts automatically
2. Enable remediation actions (like isolating a device or initiating investigation)
