Hello there, hunters! I’d like to share some of the work we’ve recently completed for advanced hunting on Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).
We’ve added some ...
Updated Feb 16, 2020
Version 5.0
Blog Post
4 MIN READ
Advanced hunting updates: USB events, machine-level actions, and schema changes
Daniel Naim are there any prerequisites for that query? like a specifics events that needs to be enabled in the the windows 10 events viewer (that aren't default)?
My devices are managed by Intune and AAD joined devices, I did some tests with your query and others I found on the web (connect and disconnect USB many times) but each time the query shows nothing, as if something else is missing in my configuration.
here's another query I tried , but still with no results:
// Find all “Mounted” storage activity within the past day
DeviceEvents
| where ActionType == "UsbDriveMount" and Timestamp > ago(100d)
| extend DriveLetter = parse_json(AdditionalFields).DriveLetter
| extend BusType = parse_json(AdditionalFields).BusType
| extend ProductName = parse_json(AdditionalFields).ProductName
| extend ProductRevision = parse_json(AdditionalFields).ProductRevision
| extend SerialNumber = parse_json(AdditionalFields).SerialNumber
| extend Manufacturer = parse_json(AdditionalFields).Manufacturer
| extend Volume = parse_json(AdditionalFields).Volume
| project DeviceName, DeviceId, Timestamp, DriveLetter, Manufacturer, ProductName, BusType, ProductRevision, SerialNumber, Volume