Cb Defense: How To Search For Files On Removable Drives

[#1]

Environment

• Cb Defense PSC Console: All Versions

Objective

Query within the CB Defense Console to gather information regarding files being run from USB devices in an environment

Resolution

1. From the Cb Defense dashboard select Investigate.
2. Identify the time frame of the events under investigation be selecting the drop down in the top right.
3. To view files that were executed or found on removable media across all devices within the time selected use this query

   (NOT "local disk" AND "the file") AND ("the file" AND NOT "on network drive") AND ("the file" AND "Removable media")

4. At any time it may be helpful to change the VIEW BY tab options in the top left between (Events, Applications, or Devices)
5. Using the above query additional filters can be applied to new queries in order to investigate specific incidents:
   1. To remove events where the signature of the file was found to be signed

      NOT processAvCategory.sigcheck:signed AND (NOT "local disk" AND "the file") AND ("the file" AND NOT "on network drive") AND ("the file" AND "Removable media")

   2. To remove events from select IPs or IP ranges use NOT “X.X.X.X”

      NOT “X.X.X.X” AND (NOT "local disk" AND "the file") AND ("the file" AND NOT "on network drive") AND ("the file" AND "Removable media")

   3. To select events from a particular policy use “POLICY_NAME” or to filter those events out use NOT “POLICY_NAME”

      NOT “POLICY_NAME” AND (NOT "local disk" AND "the file") AND ("the file" AND NOT "on network drive") AND ("the file" AND "Removable media")

   4. To investigate a specific user

      "USER_NAME" AND (NOT "local disk" AND "the file") AND ("the file" AND NOT "on network drive") AND ("the file" AND "Removable media")

Additional Notes

• In order to use more than one word as a single search term you must combine those words within quotation marks.
• To apply conditions or to evaluate within a query use: AND, OR, NOT and ( )
• For example the following search terms need to be used "as-is" when searching the Event field within the Investigate panel

  “the file”
  “local disk”
  “on network drive”
  “removable media"

• The following search terms would be replaced with variables of your choosing

  "X.X.X.X":<IP address>
  "POLICY_NAME":<Name of the policy>
  "USER_NAME":<Specific user>