Alert for each time a usb device is plugged

[JoaoSantos20]

Hello,

Is there any way to set up an alert for each time a USB device is plugged into a host?
Even if it's not malicious.

[jtalton]

Multiple analytics alerts track USB activities that do not require BrokerVM

A user connected a USB storage device to a host for the first time

A user connected a new USB storage device to a host

A user connected a new USB storage device to multiple hosts

But you are correct, configuring the BrokerVM Windows Event Collector would allow you to specify collection for event IDs 6416 & 4719

[KanwarSingh01]

@micomi Don't see Cortex XDR looking for those EVIDs (6416&4719) in default collection, I think Broker VM would be required in this case.

Probably @eluis or @jtalton can let us know?

[NathanBradley]

We created a bioc using a reg key

Seems to work 

preset = xdr_registry
| filter (action_registry_key_name contains "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\USBSTOR\Enum" and event_sub_type = REGISTRY_CREATE_KEY)

[bbarmanroy]

Hi All,

You can also consider using the following BIOC to raise alerts when a USB device is plugged in.

You can play around with the filters to whitelist allowed device IDs/vendors.