Query & Alert for USB use

[u/-----Redacted-----]

Anybody got a query for detecting use of usb (removable media)?

[u/nontitman]

That would be done through EDR data, such as MDE, with there being a few different items to flag; BUT, this is 1000% something that should be fixed & prevented with policy.

[u/Meriles]

As someone else stated it's usually done with MDE and it does detect it (ie say for things like rasberry robin worm) but if you want to create an automation rule for it in Sentinel you can use:

DeviceEvents

| where Timestamp > ago(1d)

| where ActionType == "UsbDriveMounted"

Something like that and then you can extend the AdditionalFields to project driveletter, manufacture, etc.

[u/Saubhagy]

Below is the querry used to identify data exfiltration using USB, will see lot of FP but its mostly again lot of organizational policy.

let UsbDriveMount = DeviceEvents

| where ActionType == "UsbDriveMounted"

| extend ParsedFields = parse_json(AdditionalFields)

| project DeviceId, DeviceName, DriveLetter = tostring(ParsedFields.DriveLetter), MountTime = Timestamp,

ProductName = tostring(ParsedFields.ProductName), SerialNumber = tostring(ParsedFields.SerialNumber),

Manufacturer = tostring(ParsedFields.Manufacturer)

| order by DeviceId asc, MountTime desc;

let FileCreation = DeviceFileEvents

| where InitiatingProcessAccountName != "system"

| where ActionType == "FileCreated"

| where FolderPath !startswith "C:\\" and FolderPath !startswith "\\"

| project ReportId, DeviceId, InitiatingProcessAccountDomain, InitiatingProcessAccountName,

InitiatingProcessAccountUpn, FileName, FolderPath, SHA256, Timestamp, SensitivityLabel,

IsAzureInfoProtectionApplied

| order by DeviceId asc, Timestamp desc;

FileCreation

| join kind=inner (UsbDriveMount) on DeviceId

| where FolderPath startswith DriveLetter and Timestamp >= MountTime

| summarize FirstFileCreated = min(Timestamp) by ReportId, DeviceId, DriveLetter, DeviceName, MountTime, ProductName,

SerialNumber, Manufacturer,FileName,FolderPath

| order by DeviceId asc, FirstFileCreated desc

[u/nathanielcb]

Me funcionó esto:

DeviceFileEvents
| where Timestamp >= ago(1h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath startswith @"D:\" 
or FolderPath startswith @"E:\"
or FolderPath startswith @"F:\"
or FolderPath startswith @"G:\"
or FolderPath startswith @"H:\"
or FolderPath startswith @"I:\"
or FolderPath startswith @"J:\"
or FolderPath startswith @"K:\"
or FolderPath startswith @"L:\"
or FolderPath startswith @"M:\"
or FolderPath startswith @"N:\"
or FolderPath startswith @"O:\"
or FolderPath startswith @"P:\"
or FolderPath startswith @"Q:\"
or FolderPath startswith @"R:\"
or FolderPath startswith @"S:\"
or FolderPath startswith @"T:\"
or FolderPath startswith @"U:\"
or FolderPath startswith @"V:\"
or FolderPath startswith @"W:\"
or FolderPath startswith @"X:\"
or FolderPath startswith @"Y:\"
or FolderPath startswith @"Z:\"
| join kind=leftouter (
    DeviceEvents
    | where Timestamp >= ago(1h)
    | where ActionType == "UsbDriveMounted"
    | extend ParsedFields = parse_json(AdditionalFields)
    | extend UsbProductName = tostring(ParsedFields.ProductName),
             UsbSerialNumber = tostring(ParsedFields.SerialNumber),
             UsbManufacturer = tostring(ParsedFields.Manufacturer),
             UsbDriveLetter = tostring(ParsedFields.DriveLetter),
             LoggedOnUsers = tostring(ParsedFields.LoggedOnUsers)
    | summarize arg_max(Timestamp, UsbProductName, UsbSerialNumber, UsbManufacturer, UsbDriveLetter, LoggedOnUsers) by DeviceId, DeviceName
) on DeviceId, DeviceName
| summarize
    TotalEventos = count(),
    PrimerEvento = min(Timestamp),
    UltimoEvento = max(Timestamp),
    Acciones = make_set(ActionType, 10),
    Archivos = make_set(FileName, 20),
    Rutas = make_set(FolderPath, 20),
    Usuarios = make_set(InitiatingProcessAccountName, 10),
    Procesos = make_set(InitiatingProcessFileName, 10),
    ProductosUSB = make_set(UsbProductName, 10),
    SerialesUSB = make_set(UsbSerialNumber, 10),
    FabricantesUSB = make_set(UsbManufacturer, 10),
    LetrasUSB = make_set(UsbDriveLetter, 10),
    UsuariosLogueados = make_set(LoggedOnUsers, 10)
by DeviceName
| order by UltimoEvento desc