First Time Seen Removable Device

 1[metadata]
 2creation_date = "2023/03/16"
 3integration = ["endpoint", "windows"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies newly seen removable devices by device friendly name using registry modification events. While this activity
11is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices.
12"""
13from = "now-9m"
14index = ["logs-endpoint.events.registry-*", "winlogbeat-*", "logs-windows.sysmon_operational-*", "endgame-*"]
15language = "kuery"
16license = "Elastic License v2"
17name = "First Time Seen Removable Device"
18references = [
19    "https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/USB-storage.html",
20    "https://learn.microsoft.com/en-us/windows-hardware/drivers/usbcon/usb-device-specific-registry-settings",
21]
22risk_score = 21
23rule_id = "0859355c-0f08-4b43-8ff5-7d2a4789fc08"
24severity = "low"
25tags = [
26    "Domain: Endpoint",
27    "OS: Windows",
28    "Use Case: Threat Detection",
29    "Tactic: Initial Access",
30    "Tactic: Exfiltration",
31    "Data Source: Elastic Endgame",
32    "Data Source: Elastic Defend",
33    "Data Source: Sysmon",
34]
35timestamp_override = "event.ingested"
36type = "new_terms"
37
38query = '''
39event.category:"registry" and host.os.type:"windows" and registry.value:"FriendlyName" and registry.path:*USBSTOR*
40'''
41
42
43[[rule.threat]]
44framework = "MITRE ATT&CK"
45[[rule.threat.technique]]
46id = "T1091"
47name = "Replication Through Removable Media"
48reference = "https://attack.mitre.org/techniques/T1091/"
49
50
51[rule.threat.tactic]
52id = "TA0001"
53name = "Initial Access"
54reference = "https://attack.mitre.org/tactics/TA0001/"
55[[rule.threat]]
56framework = "MITRE ATT&CK"
57[[rule.threat.technique]]
58id = "T1052"
59name = "Exfiltration Over Physical Medium"
60reference = "https://attack.mitre.org/techniques/T1052/"
61[[rule.threat.technique.subtechnique]]
62id = "T1052.001"
63name = "Exfiltration over USB"
64reference = "https://attack.mitre.org/techniques/T1052/001/"
65
66
67
68[rule.threat.tactic]
69id = "TA0010"
70name = "Exfiltration"
71reference = "https://attack.mitre.org/tactics/TA0010/"
72
73[rule.new_terms]
74field = "new_terms_fields"
75value = ["registry.path"]
76[[rule.new_terms.history_window_start]]
77field = "history_window_start"
78value = "now-7d"