← Back to SOC feed Coverage →

AV Detections with USB Disk Drive

kql MEDIUM Azure-Sentinel
DeviceEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-24T11:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use USB disk drives to exfiltrate data or deploy malware by triggering antivirus detections through malicious payloads. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential lateral movement or data theft via removable media.

KQL Query

let usbDetections =
    DeviceEvents
    | where ActionType == "AntivirusDetection" and FolderPath !startswith "c" and FolderPath matches regex "^[A-Za-z]{1}"
    | extend ParsedFields=parse_json(AdditionalFields)
    | project DetectionTime=Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath;
//Get a list of USB disk drive connections, grouped by computer name and DeviceID
let usbConnections = 
    DeviceEvents
    | where ActionType == "PnpDeviceConnected"
    | extend parsed=parse_json(AdditionalFields)
    | project Timestamp, DeviceName, DeviceId=tostring(parsed.DeviceId), ClassName=tostring(parsed.ClassName)
    | where ClassName == "DiskDrive"
    | summarize UsbFirstSeen=min(Timestamp), UsbLastSeen=max(Timestamp) by DeviceId, DeviceName;
//Join USB AV detections and connections, where the detection occurs after the USB has been plugged in
usbDetections | join kind=inner (usbConnections) on DeviceName | where DetectionTime > UsbFirstSeen and DetectionTime < UsbLastSeen
| project DetectionTime, DeviceName, ThreatName, FileName, FolderPath, DeviceId, UsbFirstSeen, UsbLastSeen
| sort by DetectionTime desc

Analytic Rule Definition

id: 12198f2f-c53b-4617-8df8-120c66cbb373
name: AV Detections with USB Disk Drive
description: |
  This query make a best-guess detection regarding which removable media device caused an AV detection.
  The query is best run over 30 days to get the full USB history.
  Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |
  let usbDetections =
      DeviceEvents
      | where ActionType == "AntivirusDetection" and FolderPath !startswith "c" and FolderPath matches regex "^[A-Za-z]{1}"
      | extend ParsedFields=parse_json(AdditionalFields)
      | project DetectionTime=Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath;
  //Get a list of USB disk drive connections, grouped by computer name and DeviceID
  let usbConnections = 
      DeviceEvents
      | where ActionType == "PnpDeviceConnected"
      | extend parsed=parse_json(AdditionalFields)
      | project Timestamp, DeviceName, DeviceId=tostring(parsed.DeviceId), ClassName=tostring(parsed.ClassName)
      | where ClassName == "DiskDrive"
      | summarize UsbFirstSeen=min(Timestamp), UsbLastSeen=max(Timestamp) by DeviceId, DeviceName;
  //Join USB AV detections and connections, where the detection occurs after the USB has been plugged in
  usbDetections | join kind=inner (usbConnections) on DeviceName | where DetectionTime > UsbFirstSeen and DetectionTime < UsbLastSeen
  | project DetectionTime, DeviceName, ThreatName, FileName, FolderPath, DeviceId, UsbFirstSeen, UsbLastSeen
  | sort by DetectionTime desc

Required Data Sources

Sentinel TableNotes
DeviceEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Protection events/AV Detections with USB Disk Drive.yaml