Elastic low stable kql

New USB Storage Device Mounted

Identifies newly seen removable devices by device.serial_number and host.id using the Elastic Defend device mount events. While this activity is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices.

View Source

Detection Logic

host.os.type:(macos or windows) and event.type:device and event.action:mount and event.outcome:success and volume.removable:true

Field Validations

Loading…

Comments (0)

Loading comments...