Get USB Devices

Retrieving a list of USB Devices plugged to the device

EDRmonitoring

FDR intermediatepor CrowdStrike (cql-hub.com) 1 min read

Query

#event_simpleName=DcUsbDeviceConnected
| DeviceTimeStamp :=parseTimeStamp(field=DeviceTimeStamp,format=seconds)
| "Time Inserted" := formatTime("%Y-%m-%dT%H:%M:%S.%L", field=DeviceTimeStamp,timezone="Zulu")
| rename([[ComputerName,"Host Name"],[DevicePropertyClassName,"Connection Type"],[DeviceManufacturer,Manufacturer],[DeviceProduct,"Product Name"], [DevicePropertyDeviceDescription,Description], [DevicePropertyClassGuid,GUID],[DeviceInstanceId,"Device ID"]])
| groupBy([aid, "Device ID"], function=([collect(["TimeInserted", ComputerName, "Connection Type",Manufacturer, "Product Name", Description, GUID])]))

Explicación

Importado desde cql-hub.com. Agrega explicación de pipes aquí.

Variables a ajustar

Revisa y ajusta los valores según tu entorno.