Forum Discussion

uae_user's avatar
uae_user
Copper Contributor
Mar 15, 2021

USB Detection for MacOS - Advance Hunting

Hi,

 

Is there a way to detect USB events on macOS devices via Advance Hunting - ATP?

 

apparently below query works fine with me but for Windows

 

DeviceEvents
| where DeviceName has "COMPUTER_NAME"
| where ActionType == "UsbDriveMounted"
| project USBMountTime = Timestamp,ReportId,InitiatingProcessAccountName,DeviceName, DeviceId, AdditionalFields
 
Thanks
No RepliesBe the first to reply