Detection rules › Kusto

Removable storage ONLINE event from secRMM

Severity
high
Source
github.com/Azure/Azure-Sentinel

Detect when a removable storage device is plugged in by the end-user.

MITRE ATT&CK coverage

TacticTechniques
Collection

Rule body

id: A22B2ECF-1478-4400-877E-07A32E53A897
name: Removable storage ONLINE event from secRMM
description: Detect when a removable storage device is plugged in by the end-user.
severity: High
kind: NRT
apiVersion: 2025-09-01
displayName: Removable Storage ONLINE
enabled: true
query: |+
    secRMM_CL | where Event_s == "ONLINE" | 
    extend AccountCustomEntity = User_s |
    extend HostCustomEntity = Computer
suppressionDuration: PT5H
suppressionEnabled: false
tactics:
- Collection
relevantTechniques:
- T1025
subTechniques: []
alertRuleTemplateName: 
incidentConfiguration:
createIncident: true
groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
aggregationKind: AlertPerResult
alertDetailsOverride: 
customDetails: 
entityMappings:
- entityType: Account
  fieldMappings:
    - identifier: AadUserId
      columnName: User_s
- entityType: Host
  fieldMappings:
    - identifier: HostName
      columnName: Computer

Stages and Predicates

Stage 1: source

secRMM_CL

Stage 2: where

| where Event_s == "ONLINE"

Stage 3: extend

| extend AccountCustomEntity = User_s

Stage 4: extend

| extend HostCustomEntity = Computer

Indicators

These rows show field, operator, and value matches.

Output fields

These fields are emitted when the rule matches.

FieldSource
AccountCustomEntityextend
HostCustomEntityextend