Drive Access

Refers to the act of accessing a data storage device, such as a hard drive, SSD, USB, or network-mounted drive. This data component logs the opening or mounting of drives, capturing activities such as reading, writing, or executing files within an assigned drive letter (e.g., C:\, /mnt/drive) or mount point. Examples:

• Removable Drive Insertion: A USB drive is inserted, assigned the letter F:\, and files are accessed.
• Network Drive Mounting: A network share \\server\share is mapped to the drive Z:\.
• External Hard Drive Access: An external drive is connected, mounted at /mnt/backup, and accessed for copying files.
• System Volume Access: The system volume C:\ is accessed for modifications to critical files.
• Cloud-Synced Drives: Cloud storage drives like OneDrive or Google Drive are accessed via local mounts.

This data component can be collected through the following measures:

Windows Event Logs
- Relevant Events:
- Event ID 4663: Logs access to file or folder objects.
- Event ID 4656: Tracks a handle to an object like a drive or file.
- Configuration:
- Enable auditing for "Object Access" in Local Security Policy.
- Use Group Policy for broader deployment: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Object Access

Linux System Logs

• Command-Line Monitoring: Use the dmesg or journalctl command to monitor drive mount/unmount events.
• Auditd Configuration: Add an audit rule for drive access: auditctl -w /mnt/drive -p rwxa -k drive_access
• Review logs via /var/log/audit/audit.log.

macOS System Logs

• Command-Line Monitoring: Use diskutil list or fs_usage to monitor drive access and mount points.
• Unified Logs: Query unified logs using log show for drive-related activities: log show --info | grep "mount"

Endpoint Detection and Response (EDR) Tools

• Use EDR solutions to monitor drive activities and collect detailed forensic data.

SIEM Tools

• Ingest logs from endpoints to detect drive access patterns. Configure rules to alert on unusual or unauthorized drive access.