AN0616
Analytic 0616
Windows
Detects USB device insertion followed by high-volume or sensitive file access and staging activity by suspicious processes or accounts.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:System
EventCode=2003
[SensitiveFilePathRegex]
Match data staging or export paths (e.g., *.docx, *.csv, *.db) to USB volume letters.
[UserContext]
Limit to users who do not normally use removable devices (e.g., service accounts).
[TimeWindow]
Correlate events within a short period following USB insert (e.g., 5–10 minutes).
AN0617
Analytic 0617
Linux
Detects USB block device mount followed by file access in sensitive directories or high-volume copy operations by user-controlled processes.
auditd:SYSCALL
open, read
auditd:SYSCALL
Kernel Device Events - USB Block Devices
[MountPath]
Look for /media/, /mnt/, /run/media/ paths associated with removable storage.
[CopyCommandSignature]
Detect rsync, cp, tar, zip activity writing to USB mount point.
[AccessRateThreshold]
Define abnormal access patterns (e.g., >100 files in <5 min).
AN0618
Analytic 0618
macOS
Detects external volume mount with Finder, Terminal, or script-initiated file copy from user profiles, sensitive folders, or cloud storage sync directories to USB.
macos:unifiedlog
Volume Mount + Process Trace + File Read
fs:fsusage
Disk Activity Tracing
macos:osquery
process_events
[DriveLabelFilter]
Flag removable volumes with suspicious or default names (e.g., NO NAME, BACKUP_01).
[ScriptExecutionContext]
Watch for shell or AppleScript execution tied to USB copy.
[VolumeMountFrequency]
Detect repeated or abnormal device mounts during work hours.