← Library
kqlElastic-2.0from elastic/detection-rules

New USB Storage Device Mounted

Quality
92
FP risk
—
Forks
0
Views
0
ATT&CK techniques
T1091T1052T1052.001
Rule sourcerules/cross-platform/initial_access_exfiltration_new_usb_device_mounted.toml
host.os.type:(macos or windows) and event.type:device and event.action:mount and event.outcome:success and volume.removable:true