Drive Access (73ff2dcc-24b1-4368-b9dc-706dd9e68354)
Refers to the act of accessing a data storage device, such as a hard drive, SSD, USB, or network-mounted drive. This data component logs the opening or mounting of drives, capturing activities such as reading, writing, or executing files within an assigned drive letter (e.g., C:\, /mnt/drive) or mount point. Examples:
- Removable Drive Insertion: A USB drive is inserted, assigned the letter
F:\, and files are accessed. - Network Drive Mounting: A network share
\\server\shareis mapped to the driveZ:\. - External Hard Drive Access: An external drive is connected, mounted at
/mnt/backup, and accessed for copying files. - System Volume Access: The system volume
C:\is accessed for modifications to critical files. - Cloud-Synced Drives: Cloud storage drives like OneDrive or Google Drive are accessed via local mounts.
This data component can be collected through the following measures:
Windows Event Logs
- Relevant Events:
- Event ID 4663: Logs access to file or folder objects.
- Event ID 4656: Tracks a handle to an object like a drive or file.
- Configuration:
- Enable auditing for "Object Access" in Local Security Policy.
- Use Group Policy for broader deployment: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Object Access
Linux System Logs
- Command-Line Monitoring: Use the
dmesgorjournalctlcommand to monitor drive mount/unmount events. - Auditd Configuration: Add an audit rule for drive access:
auditctl -w /mnt/drive -p rwxa -k drive_access - Review logs via
/var/log/audit/audit.log.
macOS System Logs
- Command-Line Monitoring: Use
diskutil listorfs_usageto monitor drive access and mount points. - Unified Logs: Query unified logs using log show for drive-related activities:
log show --info | grep "mount"
Endpoint Detection and Response (EDR) Tools
- Use EDR solutions to monitor drive activities and collect detailed forensic data.
SIEM Tools
- Ingest logs from endpoints to detect drive access patterns. Configure rules to alert on unusual or unauthorized drive access.