topic New Pen Drive Plugged in Detected in Cortex XDR Discussions

New Pen Drive Plugged in Detected

Tharaka-Wijesinghe — Thu, 05 Oct 2023 06:32:24 GMT

Can I create a rule to generate an event for detecting USB Plugged?? Is there any method to detect USB Plugged in event using cortex?? If so how??

Re: New Pen Drive Plugged in Detected

aspatil — Thu, 05 Oct 2023 07:58:30 GMT

Hello Tharaka,

USB Device plugin alert may not be possible but definitely you should be able to create a BIOC rule for USB/RemovableMedia file operation, process operation activity with a low severity priority which will only trigger an alert in Alerts Table but not create an Incident.

Let me know, if that helps.

Re: New Pen Drive Plugged in Detected

Tharaka-Wijesinghe — Fri, 06 Oct 2023 04:29:22 GMT

So this will trigger an event only if any of file in the pen drive is clicked???

Re: New Pen Drive Plugged in Detected

aspatil — Fri, 06 Oct 2023 07:07:14 GMT

Hello Tharaka,

You can try with below BIOC query and play around it:

preset = xdr_registry
| filter (action_registry_key_name contains "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\USBSTOR\Enum" and event_sub_type = REGISTRY_CREATE_KEY)

Or you can consider using the following BIOC to raise alerts when a USB device is plugged in.

You can play around with the filters to whitelist allowed device IDs/vendors.

dataset = xdr_data

| filter event_type = device and event_sub_type = Device Plug

Let me know if that helps. Kindly mark accept as solution.

Thanks!!

Re: New Pen Drive Plugged in Detected

Tharaka-Wijesinghe — Fri, 06 Oct 2023 10:58:03 GMT

Can you describe the above two queries? The problem is my plugged in USB devices details are reside on below location.

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

And what is this "event_sub_type = REGISTRY_CREATE_KEY" ??

Re: New Pen Drive Plugged in Detected

PiyushKohli — Mon, 16 Oct 2023 03:12:52 GMT

Hi @Tharaka-Wijesinghe

You may refer here as well.

Feel free to write back if you have further query.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.