Decode VolumeDeviceCharacteristics Bitmask

The query decodes the VolumeDeviceCharacteristics bitfield to reveal device properties such as removable media, network drives, virtual volumes, or portable devices.

CQL · Falcon Next-Gen SIEMCopy query

| bitfield:extractFlags(
 field=VolumeDeviceCharacteristics,
  output=[
    [0,FILE_REMOVABLE_MEDIA],
    [1,FILE_READ_ONLY_DEVICE],
    [2,FILE_FLOPPY_DISKETTE],
    [3,FILE_WRITE_ONCE_MEDIA],
    [4,FILE_REMOTE_DEVICE],
    [5,FILE_DEVICE_IS_MOUNTED],
    [6,FILE_VIRTUAL_VOLUME],
    [7,FILE_AUTOGENERATED_DEVICE_NAME],
    [8,FILE_DEVICE_SECURE_OPEN],
    [9,FILE_CHARACTERISTIC_PNP_DEVICE],
    [10,FILE_CHARACTERISTIC_TS_DEVICE],
    [11,FILE_CHARACTERISTIC_WEBDAV_DEVICE],
    [12,FILE_CHARACTERISTIC_CSV],
    [13,FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL],
    [14,FILE_PORTABLE_DEVICE]
])

Reference: GitHub CrowdStrike/logscale-community

Decode_VolumeDeviceCharacteristics_Bitmask.yml

CrowdStrike

Hunting

Endpoint

Insight

2025-10-30

Decode VolumeDeviceCharacteristics Bitmask

Get this query running in your SIEM, with someone on call.