KQL Search

This query is designed to filter and identify specific events related to USB drives on devices. Here's a simple breakdown:

1. Data Source: The query is looking at a dataset called DeviceEvents, which contains various events related to device activities.

2. Filter by Action: It filters the events to only include those where the action type is "UsbDriveMounted". This means it is specifically interested in events where a USB drive has been mounted.

3. Filter by Product Name: It further narrows down these events by checking if the ProductName in the AdditionalFields is "Virtual DVD-ROM". This indicates that the mounted USB drive is actually a virtual DVD-ROM, typically used for mounting ISO files.

4. Purpose: The comment in the query suggests that this is useful for identifying activities related to "Rougeplanet", which might be a code name for a specific threat or activity of interest.

5. Security Implication: The comment also advises blocking the mounting of ISO files through device control policies as a security measure.

In summary, this query is used to detect when virtual DVD-ROMs (ISO files) are mounted on devices, which could be part of a security investigation or threat hunting process.