External Disk Drive Or USB Storage Device Was Recognized By The System

Title: External Disk Drive Or USB Storage Device Was Recognized By The System
Status: test
Description:Detects external disk drives or plugged-in USB devices.
References:
  -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6416
Author: Keith Wright
Date: 2019-11-20
modified:2024-02-09
Tags:

• -'attack.t1091'
• -'attack.t1200'
• -'attack.lateral-movement'
• -'attack.initial-access'

Logsource:

• product: windows
• service: security

Detection:
  selection_eid:
    EventID: '6416'
  selection_field:
ClassName:'DiskDrive' DeviceDescription:'USB Mass Storage Device'   condition:all of selection_*
Falsepositives:
  -Likely
Level: low