Removable storage ONLINE event from secRMM

Back


Id	A22B2ECF-1478-4400-877E-07A32E53A897
Rulename	Removable storage ONLINE event from secRMM
Description	Detect when a removable storage device is plugged in by the end-user.
Severity	High
Tactics	Collection
Techniques	T1025
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Squadra Technologies SecRmm/Analytic Rules/Removable_Storage_ONLINE.yaml
Arm template	A22B2ECF-1478-4400-877E-07A32E53A897.json

KQL

secRMM_CL | where Event_s == "ONLINE" | 
extend AccountCustomEntity = User_s |
extend HostCustomEntity = Computer

YAML

incidentConfiguration: 
id: A22B2ECF-1478-4400-877E-07A32E53A897
subTechniques: []
apiVersion: 2025-09-01
kind: NRT
enabled: true
displayName: Removable Storage ONLINE
alertDetailsOverride: 
groupingConfiguration:
  enabled: false
  groupByEntities: []
  matchingMethod: AllEntities
  groupByAlertDetails: []
  groupByCustomDetails: []
  reopenClosedIncident: false
  lookbackDuration: PT5H
alertRuleTemplateName: 
customDetails: 
description: Detect when a removable storage device is plugged in by the end-user.
entityMappings:
- fieldMappings:
  - identifier: AadUserId
    columnName: User_s
  entityType: Account
- fieldMappings:
  - identifier: HostName
    columnName: Computer
  entityType: Host
aggregationKind: AlertPerResult
query: |
  secRMM_CL | where Event_s == "ONLINE" | 
  extend AccountCustomEntity = User_s |
  extend HostCustomEntity = Computer  
suppressionEnabled: false
relevantTechniques:
- T1025
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Squadra Technologies SecRmm/Analytic Rules/Removable_Storage_ONLINE.yaml
eventGroupingSettings: 
tactics:
- Collection
suppressionDuration: PT5H
severity: High
name: Removable storage ONLINE event from secRMM
createIncident: true

ARM