kqlElastic-2.0from elastic/detection-rules
First Time Seen Removable Device
Quality
92
FP risk
—
Forks
0
Views
0
Rule sourcerules/windows/initial_access_exfiltration_first_time_seen_usb.toml
event.category:"registry" and host.os.type:"windows" and registry.value:"FriendlyName" and registry.path:*USBSTOR*