A user connected a USB storage device for the first time

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules	Identity Threat Module
ATT&CK Tactic	Collection (TA0009), Exfiltration (TA0010)
ATT&CK Technique	Data Staged (T1074), Exfiltration Over Physical Medium: Exfiltration over USB (T1052.001)
Severity	Informational

Description

A user connected a USB storage device for the first time in the past 30 days.

Attacker's Goals

The attacker may use a USB storage device connection for data exfiltration or data collection.

Investigative actions

Investigate the USB storage device related process and file events to determine if it was used for legitimate purposes or malicious activity.