Qasim Qlf
cf84dcda62
update: External Disk Drive Or USB Storage Device Was Recognized By The System - Update selection to reflect the logic correctly fix: Uncommon Service Installation Image Path - Update filter logic to use correct modifiers --------- Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
28 lines
758 B
YAML
28 lines
758 B
YAML
title: External Disk Drive Or USB Storage Device Was Recognized By The System
|
|
id: f69a87ea-955e-4fb4-adb2-bb9fd6685632
|
|
status: test
|
|
description: Detects external disk drives or plugged-in USB devices.
|
|
references:
|
|
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6416
|
|
author: Keith Wright
|
|
date: 2019/11/20
|
|
modified: 2024/02/09
|
|
tags:
|
|
- attack.t1091
|
|
- attack.t1200
|
|
- attack.lateral_movement
|
|
- attack.initial_access
|
|
logsource:
|
|
product: windows
|
|
service: security
|
|
detection:
|
|
selection_eid:
|
|
EventID: 6416
|
|
selection_field:
|
|
- ClassName: 'DiskDrive'
|
|
- DeviceDescription: 'USB Mass Storage Device'
|
|
condition: all of selection_*
|
|
falsepositives:
|
|
- Likely
|
|
level: low
|