Refers to the act of accessing a data storage device, such as a hard drive, SSD, USB, or network-mounted drive. This data component logs the opening or mounting of drives, capturing activities such as reading, writing, or executing files within an assigned drive letter (e.g., C:\, /mnt/drive) or mount point. Examples:
F:\, and files are accessed.\\server\share is mapped to the drive Z:\./mnt/backup, and accessed for copying files.C:\ is accessed for modifications to critical files.| Name | Channel |
|---|---|
| auditd:SYSCALL | open/write syscalls on /dev/sd* or /dev/nvme* |
| auditd:SYSCALL | write syscalls to /dev/sd* targeting offset 0 |
| auditd:SYSCALL | open/write syscalls to block devices (/dev/sd*, /dev/nvme*) |
| fs:fsusage | open/read/mount operations |
| linux:osquery | hardware_events |
| linux:syslog | mount/umount or file copy logs |
| macos:osquery | usb_devices |
| WinEventLog:Sysmon | EventCode=9 |