USB Serial Number in file.Ext.device.serial_number Always Zero or Random one digit Value

Elastic Security Endpoint Security
1

Hello everyone,

I’m opening this topic because I couldn’t find any solution or open issue related to this problem, either in GitHub or other forums.

We are currently using Elastic Security as our SIEM, and one of our most relevant use cases is detecting data exfiltration to USB devices.

By default, the Elastic Defend integration logs file writes and deletions to removable drives, using the field:

file.Ext.device.bus_type:"Usb"

The logs also include additional USB device information, such as:

  • file.Ext.device.product_id

  • file.Ext.device.serial_number

  • file.Ext.device.vendor_id

However, the most important field — file.Ext.device.serial_number — is always logged as either a random number or simply 0.

For example, with a Kingston USB drive we tested:

file.Ext.device.product_id: DataTraveler 3.0
file.Ext.device.serial_number: 0
file.Ext.device.vendor_id: Kingston

But the real serial number, which can be retrieved from the Windows Registry key USBSTOR, is something like:

E0D55E62C799176068XXXXX

This discrepancy makes it very hard to reliably track specific devices.

Has anyone else experienced this issue?

Is this a known bug or a current limitation?

Is the Elastic engineering team aware of it / working on a fix?

Any ideas, workarounds, or official confirmation would be greatly appreciated.

Thanks in advance,

Best regards

2

Can you see the expected serial number from Powershell

Get-WmiObject Win32_DiskDrive |
Where-Object { $_.InterfaceType -eq "USB" } |
Select Model, SerialNumber, PNPDeviceID

3

PS C:\Windows\system32> Get-WmiObject Win32_DiskDrive |

Where-Object { $_.InterfaceType -eq "USB" } |
Select Model, SerialNumber, PNPDeviceI

Captura
Captura1183×281 11.6 KB

4

Two different devices

Captura
Captura1138×261 7.72 KB

5

Thanks for the feedback, so the serial number is not directly passed in the structures where we expect this. It seems it’s the first time we hear about it, and thanks for the hint. I guess it’s worth to cross check with macOS and Linux, if the other way of obtaining the serial number can be trusted. I’m adding a ticket to our backlog.

6

Thanks for your fast reply. We use to debug the “USBDeview” App and the best workaround we find is to use the PNPDeviceID. As you can see, the last part of the ID is equal to the Real Serial Number.

Captura de pantalla 2025-09-18 190857