Removable media mounted

Flags a removable storage / external device being recognized on the host (Security 6416, and the plug-and-play device disable/enable audit events 6419/6420). USB mass storage is a common vector for stealing data off a monitored host and for smuggling tooling onto it. This is a review candidate, not a verdict.

• T1091Replication Through Removable Media· Initial Access
• T1052.001Exfiltration Over Physical Medium: Exfiltration over USB· Exfiltration

Everyday USB drives, keyboards/mice, docks, and phones also raise 6416. Correlate with the device class (mass storage vs HID), the user, the time of day, and — most importantly — any subsequent file copies to the removable drive. Baseline sanctioned devices per host.

Declarative YAML read by the detection engine — data, never executed. Confidence 45%. Source: rules/windows/removable_media_mounted.yaml, licensed under the Apache License 2.0.

id: windows.exfiltration.removable_media_mounted
version: 1.0.0
status: experimental
severity: medium
confidence: 0.45
platforms: [windows]
mitre_techniques: [T1091, T1052.001]
description: |
  Flags a removable storage / external device being recognized on the host (Security 6416,
  and the plug-and-play device disable/enable audit events 6419/6420). USB mass storage is
  a common vector for stealing data off a monitored host and for smuggling tooling onto it.
  This is a review candidate, not a verdict.
match:
  native_event_id_any: ["6416", "6419", "6420"]
false_positive_guidance: |
  Everyday USB drives, keyboards/mice, docks, and phones also raise 6416. Correlate with the
  device class (mass storage vs HID), the user, the time of day, and — most importantly — any
  subsequent file copies to the removable drive. Baseline sanctioned devices per host.