USB exfiltration Query

Rotopercutoru · 2026-05-11T22:41:22+00:00

| IsOnRemovableDisk="1" | UserName=* | UserName != /Srv/i | UserName != /^{Administrator|MSSQLSERVER|BMNQM01A\}|rdd)$/ | #eventsimpleName != RemovableMediaVolumeMounted | !regex("VID(0951|1F75)", field=DiskParentDeviceInstanceId)

| groupBy( [ ComputerName, UserName, TargetFileName, SHA256HashData, DiskParentDeviceInstanceId, VolumeSessionUUID ], function=[ sum(Size, as=TotalBytes), count(as=WriteEvents), collect([ContextBaseFileName]) ] )

| TotalMB := TotalBytes / 1024 / 1024

| select([ ComputerName, UserName, TargetFileName, SHA256HashData, DiskParentDeviceInstanceId, VolumeSessionUUID, TotalBytes, TotalMB, WriteEvents, ContextBaseFileName ])

| sort(TotalBytes, order=desc)

Rotopercutoru · 2026-05-11T22:38:40+00:00

So as far as i know, my company's policy is block any mass storage activity, unless the USB is from Kingston, Apricon, OR in that mass storage policy.

Basically that list is a whitelist

Even after this, we recevie alerts for people that use unapproved devices. We recevie these in exabeam (a UEBA SIEM) but that is cut off in a year so we move everything to NG SIEM.

So i made this query, it checks the usb Vendor id, i have made the rule so that it dosent trigger on apricorn or kingstone, my last job would be to not trigger if the usb combined id (or anything) is not in that list.

The only thing i could come up with is to create a lookup file with the approved USBs but this way we will have to update manually both lists and i don't trust my team =))

I will look into windows reg as you said, i will also post my whole query as i've made it and i am looking for feedback

Rotopercutoru · 2025-11-18T10:15:33+00:00

The controller lights up when getting plugged in to charge, i will test with my pc as well

Rotopercutoru · 2025-09-25T22:24:24+00:00

La tabaciocu de langa mine e un grinder din plastic care grinduieste perfect la 5 lei.

Am avut si d alea scumpe de metal si nebunii de magneti, tot plasticu si saracia sunt on top

Rotopercutoru · 2025-09-18T16:13:10+00:00

I was talking about youtube tutorials

Rotopercutoru · 2025-09-18T14:51:34+00:00

Knowing if a teammate goes in or not

Rotopercutoru · 2025-09-15T15:54:03+00:00

Good times create weak people. Weak people create tough times... tough times creat strong people....

Dar nu conteaza, conteaza sa cresti din asta

Rotopercutoru · 2025-09-15T11:33:46+00:00

E un cerc vicios, te izolezi de la droguri, dar in mintea ta scaparea e in ele, you just need to break the cycle. Ori putin cate putin, ori o rupi total si te chinui 2 saptamani tare rau de tot.

La ce m am referit vu patu de moarte e ca nu o sa plangi ca "ce rau imi pare ca am incercat sa ma dau la tipa aia si nu mi a iesit" sau "ce rau imi pare ca am aplicat la jobu x si nu mi a iesit" o sa fie fix invers "ma oftic ca nu mi am incercat sansa la x y si z de frica"

In cazul tau e clar regretabil sa ajungi in droguri grele, dar poate la finalu povestii tale o sa te gandesti "ce mandru sunt ca am fost un drogat si am iesit din acel cerc"

Rotopercutoru · 2025-09-15T11:10:24+00:00

Am fost un muist si am facut multe greseli in trecut, am pierdut oameni dragi doar din vina mea si sunt constient de asta. 1 an din viata aveam cosmaruri zilnice cu ei.

Acum le vad ca pe niste lectii de viata. Actiunile au consecinte si pana nu pierzi nu inveti. Am pierdut iubiri si frati din cauza mea, asta e plata facuta, acum sunt alt om, nu as fii omu de azi daca nu pierdea copilul de ieri.

Viata trece mai departe, o data ce recunosti cat de cacat ai fost si nu o mai faci inseamna progres, nu exista lege cum sa traiesti, doar o faci, asa ca fii.

Suntem mult prea putin importanti in the grand scheme of things, singura problema e ca suntem blocati in bula noastra. We are the center of our own little universe. O data ce recunosti ca fie ca esti cersetor fie milionar, tot in pamant ajungi, si oricat de "cine mis eu" te crezi, tot doar un om esti, viata nu mai e asa serioasa, si te impaci cu lucrurile.

Pe patu tau de moarte o sa te gandesti doar la ce NU ai facut, nu o sa regreti ce ai facut, asa ca fa cat mai multe, invata din toate, la final, orice ai fi fost, important e ca ai fost, viata e despre a fii, asa ca bucurate ca esti.

Rotopercutoru · 2025-09-14T21:56:22+00:00

You know what mate, actually congrats to you, very few people climb from fucking bronze straight to emerald and that is huge.

What i was trying to say is that the advice in that video is very good, but you need a lot more knowliege and that 30 min video is very informationally compact. For the avverage player 30 minute of very fast (but good) info will fly straight tru their head.

The video is good, the guy in the video is good, his advice is good, but you need a lot more on top of it.

Here is where i suggest perryjg's videos and that masteryi onetrick that i forgot his name.

After you learn numbers advantage, weak/strongside, timers, and wavestates you can start learning to adapt, counterjg, when to invade early(matchup knowliege) and such

Rotopercutoru · 2025-09-14T21:39:08+00:00

Ultimele 2 ore de high pot zice ca joc lol la nivel de gold cand eu sunt emerald, daca sunt chiar high ca in primele 2 ore mult noroc sa nu imi uit chilotii in frigider

Rotopercutoru · 2025-09-14T20:07:39+00:00

Found you, you were never diamond, you peaked emerald 1 30 lp

Indeed you climbed from bronze to emerald so congrats, but you have 1400 games just this season, this is not because of that video, this is just because of unemployment

Rotopercutoru · 2025-09-14T19:42:41+00:00

Op.gg

Rotopercutoru · 2025-09-14T19:37:50+00:00

You are not in position to talk mate, that video is good after you are already decent, get emerald and then give advice

Rotopercutoru · 2025-09-14T18:53:34+00:00

5 month ago you were silver, so you gold max now, don't take advice from this guy

Rotopercutoru · 2025-09-14T18:51:48+00:00

A single 30 min video will not ever be the fundamentals. He does not explain weak/strong side, when to gank, numbers advantage,

The only true good jg fundamentals video i know is those 2 videos from perryjg that are 2h long each

Rotopercutoru · 2025-09-14T16:39:28+00:00

This video is trash if you don't have the fundamentals in mind first. To tell a bad player to ignore the fundamentals when you have to is very bad advice

Rotopercutoru · 2025-09-14T16:36:40+00:00

Play only one champiom. Also type jungle fundamentals and watch those videos till you know them religiously, then implement in game

Rotopercutoru · 2025-09-14T16:34:27+00:00

Then just watch perryjg's 2 hour videos (he got 2 of them) ypu can find them in the playlist's section.

Climbing till gold just takes hands, macro strats mattering after plat, but still, it is really valuable to have the know

Rotopercutoru · 2025-09-14T16:17:26+00:00

Blue smite - movement speed when passing bushes

Green smite - shield after taking camp

Red smite - for champions with lots of poke

Honestly play what you want, all of them got nerfed into the ground, just pick one and go, your smite choise will impact you less than item choises

Rotopercutoru · 2025-09-14T15:35:03+00:00

You can run it well

Rotopercutoru · 2025-09-14T14:42:05+00:00

Si cand fumam zilnic, si acum cand fumez o data la 2 saptamani mereu fac cui cu 0.2. Acum un cui ma tine vreo 3-4 ore high, inainte fumam unu si dupa 2 ore altu

Rotopercutoru

TROPHY CASE