AN1410
Analytic 1410
Windows
Adversary mounts a USB device and begins enumerating, copying, or compressing files using scripting engines, cmd, or remote access tools.
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:System
EventCode=2003
WinEventLog:Sysmon
EventCode=1
[VolumeLabel]
Can tune based on known removable device labels or whitelist
[TimeWindow]
Controls timing between device mount and sensitive file access
[TargetFileType]
Tune for sensitive file extensions (e.g., .docx, .pdf, .csv)
AN1411
Analytic 1411
Linux
Adversary mounts external drive to /media or /mnt then accesses or copies targeted data via shell, cp, or tar.
auditd:SYSCALL
open, read, mount
journald:systemd
udisks2 or udevd logs
auditd:SYSCALL
execve
[MountPathRegex]
Filter for unexpected or user-defined mount locations (e.g., /media/usb*)
[AccessMask]
Tune based on read/write access types seen during collection
AN1412
Analytic 1412
macOS
Adversary attaches USB drive and accesses sensitive files using Finder, cp, or bash scripts.
macos:unifiedlog
log stream --predicate 'eventMessage contains "USBMSC"'
fs:fsusage
file reads/writes from /Volumes/
macos:osquery
process_events
[VolumePath]
Tune by filtering removable media mounted under /Volumes
[UserContext]
Correlate activity to admin or service accounts for priority