External Disk Drive Or USB Storage Device Was Recognized By The System

calendar Feb 12, 2024 · attack.t1091 attack.t1200 attack.lateral_movement attack.initial_access  ·
Share on: linkedin copy

Detects external disk drives or plugged-in USB devices.

Sigma rule (View on GitHub)

 1title: External Disk Drive Or USB Storage Device Was Recognized By The System
 2id: f69a87ea-955e-4fb4-adb2-bb9fd6685632
 3status: test
 4description: Detects external disk drives or plugged-in USB devices.
 5references:
 6    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6416
 7author: Keith Wright
 8date: 2019/11/20
 9modified: 2024/02/09
10tags:
11    - attack.t1091
12    - attack.t1200
13    - attack.lateral_movement
14    - attack.initial_access
15logsource:
16    product: windows
17    service: security
18detection:
19    selection_eid:
20        EventID: 6416
21    selection_field:
22        - ClassName: 'DiskDrive'
23        - DeviceDescription: 'USB Mass Storage Device'
24    condition: all of selection_*
25falsepositives:
26    - Likely
27level: low

References

Related rules

to-top