domains / families / security / analyzing-usb-device-connection-history

analyzing-usb-device-connection-history

separate

Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs,

When to use

• When investigating potential data exfiltration via removable storage devices
• During insider threat investigations to track USB device usage
• For compliance audits verifying removable media policy enforcement
• When correlating USB connections with file access and copy events
• For establishing a timeline of device connections during an incident

Skill page

Source