External Disk Drive Or USB Storage Device Was Recognized By The System
This rule detects when an external disk drive or a USB mass storage device is recognized by the system. It specifically looks for Windows Security Event ID 6416, which indicates that a new external device was recognized, and further filters for devices classified as 'DiskDrive' or with the description 'USB Mass Storage Device'. This can be an indicator of initial access, data exfiltration, or the introduction of malicious software via removable media.
Sigma
