ESET USB Mount/Unmount

[j91321]

ESET USB Mount/Unmount

Contribution Details

With the release of ESET Inspect Connector 3.0 PnPDeviceConnected and PnPDeviceDisconnected were added. This creates an event for any peripheral connected as a Plug&Play device (mass storage device, HID, monitor, bluetooth devices etc.)

Additionally I'm adding Partially to File Opened subcategory. For some reason I omitted this category in the past, although it was always implemented. In ESET Inspect it's named "FileRead", but the implementation actually triggers on file open operation.

This event is generated only on specific files that may contain sensitive information such as browser related databases, credential storages etc.

Telemetry Validation

PnPDevice Events:
Tested with BashBunny in both Mass Storage device mode and HID mode

FileRead:
Standard system operation, e.g. opening browser.

Documentation or Evidence:

• Official documentation (link: )
• Screenshots attached
• Sanitized logs provided
• Private documentation (will share confidentially)

Type of Contribution

• Adding telemetry information for an existing EDR product
• Adding a new EDR product that meets eligibility criteria
• Proposing new event categories/sub-categories
• Documentation improvement
• Tool enhancement

Validation Details

EDR Product Information

• EDR Product Name:
• EDR Version:
• Operating System(s) Tested:

Testing Methodology

Tested with BashBunny in both Mass Storage device mode and HID mode

Additional Notes

None

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}