First Time Seen Removable Device Activity

This detection rule identifies newly seen removable devices by monitoring registry modification events. While not inherently malicious, this activity can be used to monitor for data exfiltration or initial access using removable devices. The rule focuses on identifying devices seen for the first time, providing a starting point for investigating potentially malicious use of USB devices. The registry keys monitored include those under the USBSTOR path, which are specific to USB storage devices. The rule is designed to be used with various data sources including Windows event logs, Sysmon, and endpoint detection and response (EDR) solutions like Elastic Endgame, Microsoft Defender XDR, and SentinelOne. This allows for broad coverage across different environments and telemetry sources.

Attack Chain

1. An attacker gains initial access to a system (e.g., via compromised credentials or social engineering).
2. The attacker connects a USB drive to the compromised system.
3. The system registers the new USB device, creating entries under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR.
4. The operating system reads the device's friendly name, triggering a registry read event with the value FriendlyName under the USBSTOR path.
5. The attacker copies sensitive files to the USB drive using tools like cmd.exe or powershell.exe.
6. The attacker removes the USB drive from the system.
7. The attacker uses the USB drive to transfer the data to an external location.

Impact

A successful attack could result in the exfiltration of sensitive data, such as proprietary information, customer data, or financial records. While the initial detection focuses on the first-time connection of a removable device, successful exfiltration can lead to significant financial loss, reputational damage, and legal consequences. The impact can range from minor data leakage to large-scale data breaches, depending on the scope and sensitivity of the compromised data.

Recommendation

• Enable Windows registry logging with Sysmon or other EDR solutions to capture registry modification events (logs-windows.sysmon_operational-*).
• Deploy the "First Time Seen Removable Device" Sigma rule to your SIEM and tune for your environment to reduce false positives.
• Investigate any alerts generated by the Sigma rule to determine the legitimacy of the new device connection.
• Review user activity logs to identify the user logged in at the time of the device connection.
• Monitor for any subsequent file access or transfer events involving the new device.
• Implement policies for registering personal devices and exclude them if deemed non-threatening.