Files Written to Removable Media
This query tracks files written to removable media (USB drives, external drives) across all platforms, aggregating the total data volume and file count per computer. It's useful for detecting potential data exfiltration attempts or monitoring removable media usage for compliance.
CQL · Falcon Next-Gen SIEMCopy query
Loading query…Files_Written_to_Removable_Media.yml
CrowdStrike
Hunting
Endpoint
Insight
