03-28-2022 06:42 AM
Is there any way to set up an alert for each time a USB device is plugged into a host?
Even if it's not malicious.
03-30-2022 06:26 AM
Multiple analytics alerts track USB activities that do not require BrokerVM
A user connected a USB storage device to a host for the first time
A user connected a new USB storage device to a host
A user connected a new USB storage device to multiple hosts
But you are correct, configuring the BrokerVM Windows Event Collector would allow you to specify collection for event IDs 6416 & 4719
04-02-2022 12:30 PM
05-12-2022 07:25 AM
We created a bioc using a reg key
Seems to work
preset = xdr_registry
| filter (action_registry_key_name contains "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\USBSTOR\Enum" and event_sub_type = REGISTRY_CREATE_KEY)
05-12-2022 07:21 PM
You can also consider using the following BIOC to raise alerts when a USB device is plugged in.
You can play around with the filters to whitelist allowed device IDs/vendors.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!