Detection rules › Kusto
Removable storage ONLINE event from secRMM
Detect when a removable storage device is plugged in by the end-user.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Collection |
Rule body
id: A22B2ECF-1478-4400-877E-07A32E53A897
name: Removable storage ONLINE event from secRMM
description: Detect when a removable storage device is plugged in by the end-user.
severity: High
kind: NRT
apiVersion: 2025-09-01
displayName: Removable Storage ONLINE
enabled: true
query: |+
secRMM_CL | where Event_s == "ONLINE" |
extend AccountCustomEntity = User_s |
extend HostCustomEntity = Computer
suppressionDuration: PT5H
suppressionEnabled: false
tactics:
- Collection
relevantTechniques:
- T1025
subTechniques: []
alertRuleTemplateName:
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: false
reopenClosedIncident: false
lookbackDuration: PT5H
matchingMethod: AllEntities
groupByEntities: []
groupByAlertDetails: []
groupByCustomDetails: []
eventGroupingSettings:
aggregationKind: AlertPerResult
alertDetailsOverride:
customDetails:
entityMappings:
- entityType: Account
fieldMappings:
- identifier: AadUserId
columnName: User_s
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: Computer
Stages and Predicates
Stage 1: source
secRMM_CL
Stage 2: where
| where Event_s == "ONLINE"
Stage 3: extend
| extend AccountCustomEntity = User_s
Stage 4: extend
| extend HostCustomEntity = Computer
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Event_s | eq |
| field:"Event_s" kind:eq value:"ONLINE" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
AccountCustomEntity | extend |
HostCustomEntity | extend |