New Pen Drive Plugged in Detected

[Tharaka-Wijesinghe]

Can I create a rule to generate an event for detecting USB Plugged?? Is there any method to detect USB Plugged in event using cortex?? If so how??

[aspatil]

Hello Tharaka,

USB Device plugin alert may not be possible but definitely you should be able to create a BIOC rule for USB/RemovableMedia file operation, process operation activity with a low severity priority which will only trigger an alert in Alerts Table but not create an Incident.

Let me know, if that helps.

[Tharaka-Wijesinghe]

So this will trigger an event only if any of file in the pen drive is clicked???

[aspatil]

Hello Tharaka,

You can try with below BIOC query and play around it:

preset = xdr_registry
| filter (action_registry_key_name contains "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\USBSTOR\Enum" and event_sub_type = REGISTRY_CREATE_KEY)

Or you can consider using the following BIOC to raise alerts when a USB device is plugged in.

You can play around with the filters to whitelist allowed device IDs/vendors.

dataset = xdr_data

| filter event_type = device and event_sub_type = Device Plug

Let me know if that helps. Kindly mark accept as solution.

Thanks!!

[Tharaka-Wijesinghe]

Can you describe the above two queries? The problem is my plugged in USB devices details are reside on below location. 

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

And what is this "event_sub_type = REGISTRY_CREATE_KEY" ??

[PiyushKohli]

Hi @Tharaka-Wijesinghe 

You may refer here as well. 

Feel free to write back if you have further query.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.