Defender XDR, DeviceFileevents actiontype: FileCreated

Question

Hi,
When looking into devicefileevents table, we can see file creation events (action type: FileCreated) under the USB folder path. Are those the files that was moved/copied from device to USB or the file that already existed in the usb and was detect by defender when usb was plugged in?

Answer 1

The file creation events (action type: FileCreated) recorded in the DeviceFileEvents table under the USB folder path can indicate either of the following scenarios:

1. Files Moved or Copied to USB: These events may represent files that were actively moved or copied from the device to the USB drive. In this case, the action would be logged as a new file creation event on the USB drive.
2. Existing Files on USB: Alternatively, these events could also indicate files that were already present on the USB drive and were detected by Microsoft Defender when the USB was plugged in. In this scenario, the Defender may log the event as it scans the USB for existing files.

To determine the exact nature of the events, additional context or details about the specific actions taken prior to the logging of these events may be required.