Detects removable drive insertion followed by unusual file access, compression, or staging activity by unauthorized users or unexpected processes.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| File Creation (DC0039) | WinEventLog:Sysmon | EventCode=11 |
| File Access (DC0055) | WinEventLog:Security | EventCode=4663 |
| Drive Creation (DC0042) | WinEventLog:System | EventCode=1006,10001 |
| Field | Description |
|---|---|
| DriveTypeFilter | Filter on removable (e.g., USB) drives only. |
| ProcessNameExclusionList | Exclude known, approved backup or sync utilities. |
| TimeWindow | Limit correlation of file access and device mount to a defined window (e.g., <5 minutes). |
Detects mounted external devices (via /media or /mnt) followed by large file read or copy operations by shell scripts, unauthorized users, or staging tools (e.g., tar, rsync).
| Data Component | Name | Channel |
|---|---|---|
| File Access (DC0055) | auditd:SYSCALL | open |
| Drive Creation (DC0042) | auditd:SYSCALL | device event logs |
| Field | Description |
|---|---|
| MountPointPattern | Monitor mount points like /media, /mnt, or /run/media. |
| UserGroupScope | Restrict detection to non-root or unexpected users. |
| AccessVolumeThreshold | Alert on large file access or copy events. |
Detects mounting of external volumes followed by high-volume or sensitive file access via Finder, terminal, or third-party apps (e.g., rsync, zip).
| Data Component | Name | Channel |
|---|---|---|
| Drive Creation (DC0042) | macos:unifiedlog | Volume Mount + File Read |
| File Access (DC0055) | macos:osquery | file_events |
| Command Execution (DC0064) | fs:fsusage | file system activity monitor |
| Field | Description |
|---|---|
| VolumeNamePattern | Detect suspicious or unrecognized drive labels (e.g., UNTITLED, BACKUP_VOL). |
| ProcessOrigin | Detect CLI-based copy operations vs. expected GUI usage. |
| UserSessionCheck | Alert if process and session context are mismatched (e.g., script from screensaver context). |