Detection of New USB Storage Device Mounting

This brief concerns a detection capability for monitoring removable media usage across enterprise endpoints. Adversaries frequently leverage USB storage devices to introduce malware, achieve initial access, facilitate lateral movement, or exfiltrate sensitive data by exploiting the plug-and-play nature of modern operating systems. The Elastic detection rule tracks device mount events, specifically monitoring for new combinations of device serial numbers and host identifiers. By identifying devices that have not been previously seen on a specific host within a defined history window, security teams can focus investigations on potentially unauthorized hardware usage. While the presence of a new USB device is not inherently malicious, it serves as a critical indicator for identifying abnormal activity in environments where removable media usage should be tightly controlled.

Impact

Successful exploitation of removable media can lead to the introduction of malicious payloads into isolated environments, the theft of sensitive internal data, or the facilitation of lateral movement across network segments. Unauthorized use of USB drives poses significant risks to data integrity and organizational security policy compliance.

Recommendation

Prioritize the implementation of device control policies to restrict unauthorized hardware.

• Deploy the provided logic to track new device serial numbers and host identifiers to your SIEM.
• Establish a process to inventory and register approved company-issued USB devices to reduce noise.
• Review file access and transfer logs immediately following a 'new device' alert to assess if data exfiltration is occurring.
• If a device is identified as malicious, utilize Device Control policies to block the specific serial number across the environment.
• Isolate hosts where unauthorized devices were detected to prevent potential lateral movement or malware propagation.