Deployable detection rules
2 vendor-native detections · ready to paste into your SIEM · cross-linked to ATT&CK
◈
Detections
2 shown of 2Execution from a Removable Media with Network Connection
Identifies process execution from a removable media and by an unusual process. Adversaries may move onto systems,
possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of
Autorun features when the media is inserted into a system and executes.
Show query
sequence by process.entity_id with maxspan=5m
[process where host.os.type == "windows" and event.action == "start" and
/* Direct Exec from USB */
(process.Ext.device.bus_type : "usb" or process.Ext.device.product_id : "USB *") and
(process.code_signature.trusted == false or process.code_signature.exists == false) and
not process.code_signature.status : ("errorExpired", "errorCode_endpoint*")]
[network where host.os.type == "windows" and event.action == "connection_attempted"]
Windows Replication Through Removable Media
The following analytic detects the creation or dropping of executable or script files in the root directory of a removable drive. It leverages data from the Endpoint.Filesystem datamodel, focusing on specific file types and their creation paths. This activity is significant as it may indicate an attempt to spread malware, such as ransomware, via removable media. If confirmed malicious, this behavior could lead to unauthorized code execution, lateral movement, or persistence within the network, potentially compromising sensitive data and systems.
Show query
|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk", "*.url") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | eval dropped_file_path = split(file_path, "\\") | eval dropped_file_path_split_count = mvcount(dropped_file_path) | eval root_drive = mvindex(dropped_file_path,0) | where LIKE(root_drive, "%:") AND dropped_file_path_split_count = 2 AND root_drive!= "C:" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_replication_through_removable_media_filter`Showing 1-2 of 2