Elastic low stable kql

First Time Seen Removable Device

Identifies newly seen removable devices by device friendly name using registry modification events. While this activity is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices.

View Source

Detection Logic

event.category:"registry" and host.os.type:"windows" and registry.value:"FriendlyName" and registry.path:*USBSTOR*

Field Validations

Loading…

Comments (0)

Loading comments...