AN0342
Analytic 0342
Windows
Detects removable drive insertion followed by unusual file access, compression, or staging activity by unauthorized users or unexpected processes.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:System
EventCode=1006, 10001
[DriveTypeFilter]
Filter on removable (e.g., USB) drives only.
[ProcessNameExclusionList]
Exclude known, approved backup or sync utilities.
[TimeWindow]
Limit correlation of file access and device mount to a defined window (e.g., <5 minutes).
AN0343
Analytic 0343
Linux
Detects mounted external devices (via /media or /mnt) followed by large file read or copy operations by shell scripts, unauthorized users, or staging tools (e.g., tar, rsync).
auditd:SYSCALL
open
auditd:SYSCALL
device event logs
[MountPointPattern]
Monitor mount points like /media, /mnt, or /run/media.
[UserGroupScope]
Restrict detection to non-root or unexpected users.
[AccessVolumeThreshold]
Alert on large file access or copy events.
AN0344
Analytic 0344
macOS
Detects mounting of external volumes followed by high-volume or sensitive file access via Finder, terminal, or third-party apps (e.g., rsync, zip).
macos:unifiedlog
Volume Mount + File Read
macos:osquery
file_events
fs:fsusage
file system activity monitor
[VolumeNamePattern]
Detect suspicious or unrecognized drive labels (e.g., UNTITLED, BACKUP_VOL).
[ProcessOrigin]
Detect CLI-based copy operations vs. expected GUI usage.
[UserSessionCheck]
Alert if process and session context are mismatched (e.g., script from screensaver context).