T1025

Data from Removable Media

Collection Last updated:

Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to exfiltration. Threat actors including APT28, Gamaredon Group, and OilRig have leveraged this technique. Malware families such as USBStealer, GravityRAT, Rover, Crimson, Crutch, and BADNEWS implement automated USB harvesting — copying files matching predefined extension lists (documents, credentials, archives) to staging directories for later exfiltration.

What is T1025 Data from Removable Media?

Data from Removable Media (T1025) maps to the Collection tactic — the adversary is trying to gather data of interest to their goal in MITRE ATT&CK.

This page provides production-ready detection logic for Data from Removable Media, covering the data sources and telemetry it touches: File: File Access, File: File Read, Microsoft Defender for Endpoint, Process: Process Creation. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Collection
Technique
T1025 Data from Removable Media
Canonical reference
https://attack.mitre.org/techniques/T1025/
Microsoft Sentinel / Defender
kusto 
let SensitiveExtensions = dynamic([".doc", ".docx", ".xls", ".xlsx", ".pdf", ".ppt", ".pptx",
  ".txt", ".csv", ".kdbx", ".pfx", ".pem", ".key", ".p12", ".zip", ".rar", ".7z",
  ".bak", ".sql", ".db", ".sqlite", ".conf", ".config", ".xml", ".json"]);
let LookbackWindow = 1h;
let BulkAccessThreshold = 20;
// Branch 1: Bulk file reads from removable media paths
let BulkRemovableAccess =
DeviceFileEvents
| where Timestamp > ago(LookbackWindow)
| where ActionType in ("FileRead", "FileCopied", "FileCreated")
| where FolderPath matches regex @"(?i)^[D-Z]:\\"
| where not(FolderPath has_any ("C:\\Windows", "C:\\Program Files", "C:\\ProgramData", "C:\\Users"))
| extend FileExt = tolower(tostring(split(FileName, ".")[-1]))
| extend FullExt = strcat(".", FileExt)
| where FullExt in (SensitiveExtensions)
| summarize
    FileCount = count(),
    UniqueExtensions = dcount(FileExt),
    FileList = make_set(FileName, 10),
    FolderList = make_set(FolderPath, 5),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where FileCount >= BulkAccessThreshold
| extend DetectionType = "BulkRemovableMediaAccess"
| extend RiskScore = case(
    FileCount >= 100, "Critical",
    FileCount >= 50, "High",
    FileCount >= 20, "Medium",
    "Low");
// Branch 2: Suspicious process accessing removable media paths
let SuspiciousRemovableProcessAccess =
DeviceFileEvents
| where Timestamp > ago(LookbackWindow)
| where ActionType in ("FileRead", "FileCopied", "FileCreated")
| where FolderPath matches regex @"(?i)^[D-Z]:\\"
| where not(FolderPath has_any ("C:\\Windows", "C:\\Program Files", "C:\\ProgramData", "C:\\Users"))
| where InitiatingProcessFileName in~ (
    "powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "rundll32.exe", "python.exe", "python3.exe",
    "xcopy.exe", "robocopy.exe", "forfiles.exe"
    )
    or InitiatingProcessCommandLine has_any ("xcopy", "robocopy", "copy", "Get-ChildItem", "Copy-Item", "dir ")
| summarize
    FileCount = count(),
    FileList = make_set(FileName, 10),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where FileCount >= 5
| extend DetectionType = "SuspiciousProcessRemovableAccess"
| extend RiskScore = "High";
// Union results
BulkRemovableAccess
| project Timestamp=LastSeen, DeviceName, AccountName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, FileCount, FileList, FolderList, DetectionType, RiskScore
| union (
    SuspiciousRemovableProcessAccess
    | project Timestamp=LastSeen, DeviceName, AccountName, InitiatingProcessFileName,
        InitiatingProcessCommandLine, FileCount, FileList, FolderList=dynamic([]), DetectionType, RiskScore
)
| sort by Timestamp desc

Detects data collection from removable media using DeviceFileEvents. Two detection branches: (1) bulk file reads of sensitive extensions from non-C: drive paths meeting a threshold of 20+ files within 1 hour, with risk scoring based on volume; (2) suspicious scripting and copy-utility processes (PowerShell, robocopy, xcopy, forfiles) accessing non-C: drive paths. Drive letter heuristic (D-Z) targets removable/external media while excluding system drive. Sensitive extension list covers documents, credentials, databases, archives, and configuration files commonly targeted by USB stealers.

high severity medium confidence

Data Sources

File: File Access File: File Read Microsoft Defender for Endpoint Process: Process Creation

Required Tables

DeviceFileEvents

False Positives

  • Legitimate backup software (Acronis, Veeam, Windows Backup) reading files from external USB drives or backup volumes assigned non-C: drive letters
  • Software developers or IT staff intentionally copying project files from USB drives for deployment or archiving
  • CD/DVD optical drives assigned D: or E: letters accessed for legitimate software installation or media playback
  • Secondary internal hard drives or partitions assigned drive letters in the D-Z range during normal file access or synchronization
  • Automated DLP (Data Loss Prevention) agents that perform file scanning on all connected drives as part of policy enforcement

Sigma rule & cross-platform mapping

The detection logic for Data from Removable Media (T1025) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1025 Sigma rules on detection.fyi

Platform-specific guides for T1025

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-13 Research depth: deep
References (5)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Bulk File Collection from USB Drive via PowerShell Copy-Item

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Get-ChildItem', 'Copy-Item', and the fake USB path. Sysmon Event ID 11: File Create events for each copied file in the staging directory. DeviceFileEvents: multiple FileRead and FileCreated entries for the extension sweep. DeviceProcessEvents: PowerShell process with copy pipeline command line.

  2. Test 2Removable Media Enumeration via CMD dir and xcopy

    Expected signal: Sysmon Event ID 1: Process Create for cmd.exe and xcopy.exe with command lines showing the target path. Sysmon Event ID 11: File Create events for each file copied to usb_collect. Security Event ID 4688 (with command line auditing enabled) for cmd.exe and xcopy.exe. DeviceFileEvents: xcopy.exe performing FileRead on source and FileCreated on destination.

  3. Test 3Credential File Targeted Collection from Removable Media

    Expected signal: Sysmon Event ID 1: PowerShell process with Get-ChildItem filtering .kdbx/.pfx/.key extensions and Copy-Item to staging. Sysmon Event ID 11: File Create events for .kdbx, .pfx, id_rsa, .key in the staging directory. DeviceFileEvents: FileRead on credential-extension files. The credential-targeted hunting query will match immediately on file extensions.

  4. Test 4Robocopy Mirroring of Removable Media to Network Share

    Expected signal: Sysmon Event ID 1: Process Create for robocopy.exe with source path, destination path, /E /COPYALL flags. Sysmon Event ID 11: File Create events for all mirrored files in staging directory. Sysmon Event ID 11: Log file creation (%TEMP%\robocopy_collection.log). DeviceFileEvents: robocopy.exe FileRead from source and FileCreated at destination.

Response Playbook

Triage

  1. Identify the initiating process and command line — was access triggered by a known backup agent (Acronis, Veeam, Windows Backup), a user-initiated copy operation, or an unrecognized process (random name, temp path, .exe from AppData)?
  2. Determine the drive letter and verify media type — use Windows Event ID 6416 (A new external device was recognized) in the System log or DeviceEvents in MDE to confirm whether the drive is a USB, optical disk, or secondary internal volume
  3. Review the file extensions accessed — a narrow targeted set (.kdbx, .pfx, .pem) indicates credential harvesting; a broad document sweep (.doc, .xls, .pdf) indicates bulk collection by a stealer
  4. Check the timing relative to device insertion — file access within seconds of a WPD/USB device insertion event (System log, Event ID 2003 or Sysmon) indicates automated collection triggered on plug-in
  5. Examine where copied files went — did the initiating process subsequently write files to a staging directory, compress them (7z, zip, rar), or upload to a network location? Correlate with DeviceFileEvents writes to %TEMP%, %APPDATA%, or network paths
  6. Investigate the user context — is this a privileged account, service account, or a standard user who wouldn't normally perform bulk copy operations from removable media?
  7. Look at network connections from the initiating process in the same time window — immediate exfiltration after collection (T1041, T1048) would appear as outbound connections from the same process

Containment

  1. If an active malicious process is identified performing the collection: terminate the process via EDR and isolate the endpoint from the network to prevent exfiltration of already-collected files
  2. If files have already been staged to a local directory: preserve the staging directory as evidence before the endpoint is wiped — copy the contents to a forensic share while preventing further network access
  3. If USB insertion triggered the collection (automated stealer behavior): physically remove the USB device and bag/tag it as evidence; do not reinsert into any systems until forensic analysis is complete
  4. Block the malicious process hash at the EDR policy level to prevent re-execution on this and other endpoints in the fleet
  5. If the removable media itself is infected (USBStealer/autorun-based): scan the device with an isolated offline scanner; notify other users who may have inserted the same device
  6. Review and enforce USB device control policies (Group Policy: Computer Configuration > Administrative Templates > System > Removable Storage Access) to block unapproved removable storage on sensitive endpoints

Evidence Collection

  1. Windows System Log — Event ID 6416 (A new external device was recognized by the system) and Event ID 2003 for device insertion timestamps and device identifiers (VID/PID, serial number)
  2. Sysmon Event ID 11 (File Create) — full path of files accessed or created on the removable media drive letter, with process GUID linking back to the initiating process
  3. Sysmon Event ID 1 (Process Create) — command line of the collecting process, parent process, and integrity level
  4. MDE DeviceFileEvents — ActionType=FileRead/FileCopied for all file access events on the removable drive path, with timestamps and process context
  5. MDE DeviceEvents — RemovableMediaMount action type to confirm USB insertion/removal timeline
  6. Prefetch files for the collecting process — C:\Windows\Prefetch\<PROCESS>-*.pf contains execution timestamps and recently accessed file paths including removable media references
  7. File system metadata on the removable drive — use forensic tools to recover file access timestamps (MACB) and potential MFT entries showing deleted staging files
  8. Registry — HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR for historical USB device insertions (DeviceDesc, FriendlyName, serial numbers, first/last install timestamps)
  9. Staging directory contents — if files were copied to %TEMP%, %APPDATA%, or a custom path, capture the directory listing and file hashes before remediation
  10. Network proxy/firewall logs — outbound connections from the endpoint in the 30 minutes following the file access event, particularly to non-corporate external IPs

Escalation Criteria

  • ! Automated collection pattern confirmed: file access triggered within seconds of USB insertion, targeting a predefined extension list without user interaction
  • ! Credential-related files accessed: .kdbx (KeePass), .pfx/.pem/.p12 (certificates/private keys), password manager vaults, SSH key files (.id_rsa, .ppk)
  • ! Staging directory identified with compressed archive (.zip, .rar, .7z) containing files copied from removable media, indicating preparation for exfiltration
  • ! Network connection from the collecting process to an external IP within 10 minutes of the collection event, indicating immediate automated exfiltration
  • ! The same process or hash has triggered on multiple endpoints in the environment, indicating worm-like USB propagation (USBStealer pattern)
  • ! Process binary located in %TEMP%, %APPDATA%, or other user-writable non-standard paths, indicating a dropped payload rather than a legitimate application

Investigation Guide

Forensic Artifacts

  • > Registry: HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR — full history of all USB storage devices ever connected (device description, VID/PID, serial number, first/last install date per user)
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Enum\USB — lower-level USB device enumeration history including hubs and non-storage devices
  • > Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 — user-specific USB mount history keyed by device GUID
  • > Event Log: System — Event ID 6416 (New device recognized), Event ID 20001 (Device driver installed), Event ID 7036 (Service start for WPDBusEnum) correlate with USB insertion timeline
  • > Shellbag artifacts: HKCU\Software\Microsoft\Windows\Shell\BagMRU — explorer shell folder access history including removable drive browsing activity
  • > LNK/Jump List files: %APPDATA%\Microsoft\Windows\Recent\ — recent files opened from removable drive paths retain source path even after device removal
  • > Prefetch: C:\Windows\Prefetch\*.pf — execution evidence for the collecting process, includes recently referenced file paths from USB drives
  • > Volume Shadow Copies — may preserve file system state of removable drive if VSS was capturing at time of collection (uncommon for USB but possible for eSATA)
  • > MFT ($MFT) on the removable media drive — records file access timestamps; use forensic tools to parse even after USB removal if drive image was acquired
  • > NTFS USN Journal ($UsnJrnl) on the removable media — records file create/read/delete operations with timestamps; useful for establishing exact collection timeline

Tuning Guidance

The primary source of false positives is backup software and secondary internal drives. Build an allowlist of known backup agent process names and hashes (e.g., Acronis True Image, Veeam Agent, Windows Backup/wbengine.exe, robocopy.exe when initiated by backup service accounts). Exclude these by process hash rather than name to prevent spoofing. For environments with shared external drives used by IT staff, create a named exclusion for specific drive serial numbers (obtained from USBSTOR registry) paired with specific user accounts. Adjust the BulkAccessThreshold (default 20 files) based on your environment's typical USB usage — in air-gapped environments with heavy USB data transfer, raise to 50+; in standard corporate environments, 20 is appropriate. Consider implementing a device control allowlist (MDE Device Control, Group Policy Removable Storage) so only pre-approved USB devices can mount — this dramatically reduces the false positive surface. The credential-targeting hunting query (kdbx, pfx, pem) has very low false positive rates and should run at low threshold even in high-noise environments.

Hunting Queries

Hunt for file access bursts on removable media within 5 minutes of USB insertion — the signature pattern of automated USB stealer malware (GravityRAT, Rover, BADNEWS, Crimson). A high file count immediately after insertion, especially with no user interaction, strongly indicates malware-driven automated collection.

Hunting — KQL
kql 
// Hunt: USB device insertions correlated with subsequent file access bursts
let USBInsertions = DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "UsbDriveMounted"
| project InsertionTime=Timestamp, DeviceName, DriveLetter=tostring(AdditionalFields.DriveLetter), AccountName;
let FileAccessAfterInsert = DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in ("FileRead", "FileCopied")
| where FolderPath matches regex @"(?i)^[D-Z]:\\"
| project AccessTime=Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName, AccountName;
USBInsertions
| join kind=inner FileAccessAfterInsert on DeviceName
| where AccessTime between (InsertionTime .. (InsertionTime + 5m))
| summarize FilesAccessed=count(), ProcessList=make_set(InitiatingProcessFileName), FileList=make_set(FileName, 20)
    by DeviceName, AccountName, InsertionTime, DriveLetter
| where FilesAccessed >= 10
| sort by FilesAccessed desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-7d
| eval DriveLetter=upper(substr(TargetFilename, 1, 2))
| eval IsRemovable=if(match(TargetFilename, "(?i)^[D-Z]:\\\\"), 1, 0)
| where IsRemovable=1
| eval FileExt=lower(replace(TargetFilename, ".*\.([^.]+)$", ".\1"))
| eval IsSensitive=if(match(FileExt, "\.(doc|docx|xls|xlsx|pdf|kdbx|pfx|pem|key|zip|rar|7z|sql|db)"), 1, 0)
| where IsSensitive=1
| bucket span=5m _time
| stats count as FileCount, dc(TargetFilename) as UniqueFiles, values(FileExt) as Exts by _time, host, User, DriveLetter, Image
| where UniqueFiles >= 10
| sort - UniqueFiles

Hunt for unexpected processes (children of system processes like svchost, winlogon, services) accessing removable media paths. Malware that injects into or is spawned by system processes to perform USB collection will appear as unusual parent-child relationships in file access telemetry.

Hunting — KQL
kql 
// Hunt: Processes with unusual parent spawning accessing removable media
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in ("FileRead", "FileCopied", "FileCreated")
| where FolderPath matches regex @"(?i)^[D-Z]:\\"
| where not(FolderPath has_any ("C:\\Windows", "C:\\Program"))
| where InitiatingProcessParentFileName in~ (
    "explorer.exe", "winlogon.exe", "services.exe",
    "svchost.exe", "lsass.exe", "taskeng.exe", "taskhost.exe"
    )
| where InitiatingProcessFileName !in~ (
    "explorer.exe", "svchost.exe", "taskhostw.exe",
    "sihost.exe", "SearchIndexer.exe", "SearchProtocolHost.exe"
    )
| summarize FileCount=count(), Files=make_set(FileName, 10), Folders=make_set(FolderPath, 5)
    by DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
| where FileCount >= 5
| sort by FileCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-7d
| eval IsRemovable=if(match(TargetFilename, "(?i)^[D-Z]:\\\\"), 1, 0)
| where IsRemovable=1
| eval SuspectParent=if(match(lower(ParentImage), "(explorer|winlogon|services|svchost|lsass|taskeng|taskhost)"), 1, 0)
| eval SuspectChild=if(NOT match(lower(Image), "(explorer|svchost|taskhostw|sihost|searchindexer)"), 1, 0)
| where SuspectParent=1 AND SuspectChild=1
| stats count as FileCount, dc(TargetFilename) as UniqueFiles, values(Image) as Processes by host, User, ParentImage
| where UniqueFiles >= 5
| sort - UniqueFiles

Targeted hunt for credential-bearing files (KeePass databases, private keys, certificates, SSH keys) being read from removable media. Even a single access to .kdbx or .pfx files on a USB drive by a non-standard process is high-confidence malicious. This covers the OilRig, APT28, and InvisiMole credential harvesting patterns.

Hunting — KQL
kql 
// Hunt: Credential-targeted file collection from removable media
DeviceFileEvents
| where Timestamp > ago(14d)
| where ActionType in ("FileRead", "FileCopied")
| where FolderPath matches regex @"(?i)^[D-Z]:\\"
| extend FileExt = tolower(tostring(split(FileName, ".")[-1]))
| where FileExt in ("kdbx", "pfx", "pem", "key", "p12", "ppk", "id_rsa", "id_dsa", "crt")
    or FileName has_any ("password", "passwd", "credentials", "secret", "vault", "wallet", "keystore", "private")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath,
    InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-14d
| eval IsRemovable=if(match(TargetFilename, "(?i)^[D-Z]:\\\\"), 1, 0)
| where IsRemovable=1
| eval IsCredFile=if(match(lower(TargetFilename), "(\.kdbx|\.pfx|\.pem|\.key|\.p12|\.ppk|id_rsa|id_dsa|\.crt|password|passwd|credential|secret|vault|wallet|keystore|private)"), 1, 0)
| where IsCredFile=1
| table _time, host, User, TargetFilename, Image, CommandLine, ParentImage
| sort - _time

Atomic Red Team Tests

Test 1 Bulk File Collection from USB Drive via PowerShell Copy-Item
windows

Simulates automated malware behavior by using PowerShell to enumerate and copy all document files from a removable media path to a local staging directory. This mirrors the behavior of malware families like GravityRAT, Rover, and BADNEWS that iterate a predefined extension list. Uses a safe temp directory as both source and destination to avoid requiring an actual USB drive.

Command

powershell 
# Setup: create fake 'USB' source directory with sample files
$fakeUSB = "$env:TEMP\fake_usb_E"
New-Item -ItemType Directory -Path $fakeUSB -Force | Out-Null
1..25 | ForEach-Object { New-Item -Path "$fakeUSB\document_$_.docx" -ItemType File | Out-Null }
1..10 | ForEach-Object { New-Item -Path "$fakeUSB\report_$_.pdf" -ItemType File | Out-Null }

# Simulate USB collection (target extensions matching stealer behavior)
$staging = "$env:TEMP\usb_staging"
New-Item -ItemType Directory -Path $staging -Force | Out-Null
$extensions = @('*.docx','*.pdf','*.xlsx','*.txt','*.csv')
foreach ($ext in $extensions) {
    Get-ChildItem -Path $fakeUSB -Filter $ext -Recurse | Copy-Item -Destination $staging
}

Cleanup

powershell 
Remove-Item -Recurse -Force "$env:TEMP\fake_usb_E" -ErrorAction SilentlyContinue; Remove-Item -Recurse -Force "$env:TEMP\usb_staging" -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Get-ChildItem', 'Copy-Item', and the fake USB path. Sysmon Event ID 11: File Create events for each copied file in the staging directory. DeviceFileEvents: multiple FileRead and FileCreated entries for the extension sweep. DeviceProcessEvents: PowerShell process with copy pipeline command line.

Expected Detection

KQL BulkRemovableAccess branch fires if the fake_usb_E directory matches the drive heuristic and file count exceeds threshold. SPL query detects FileCount >= 10 for the PowerShell process. SuspiciousProcessRemovableAccess fires on powershell.exe with Get-ChildItem/Copy-Item accessing the path.

Test 2 Removable Media Enumeration via CMD dir and xcopy
windows

Uses Windows built-in cmd.exe with dir and xcopy commands to enumerate and copy files from a removable drive path, simulating how APT28 backdoors and simpler malware use native Windows utilities to avoid dropping additional tools. The dir command with /s flag generates a recursive listing, and xcopy replicates bulk file transfer behavior.

Command

powershell 
rem Setup fake removable drive path
mkdir %TEMP%\sim_usb_D 2>nul
echo sensitive_data > %TEMP%\sim_usb_D\financials.xlsx
echo credentials > %TEMP%\sim_usb_D\passwords.txt
echo contract > %TEMP%\sim_usb_D\contract_2026.pdf

rem Enumerate contents (discovery phase)
cmd.exe /c dir %TEMP%\sim_usb_D\ /s /b

rem Bulk copy to staging (collection phase)
mkdir %TEMP%\usb_collect 2>nul
xcopy %TEMP%\sim_usb_D\*.* %TEMP%\usb_collect\ /E /H /Y

Cleanup

powershell 
rmdir /s /q %TEMP%\sim_usb_D 2>nul & rmdir /s /q %TEMP%\usb_collect 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for cmd.exe and xcopy.exe with command lines showing the target path. Sysmon Event ID 11: File Create events for each file copied to usb_collect. Security Event ID 4688 (with command line auditing enabled) for cmd.exe and xcopy.exe. DeviceFileEvents: xcopy.exe performing FileRead on source and FileCreated on destination.

Expected Detection

KQL SuspiciousProcessRemovableAccess branch fires on xcopy.exe accessing the simulated removable path. SPL detects xcopy.exe (matched as suspicious process) with file access events. Hunting query 1 (burst pattern) fires if file count threshold is met within the time window.

Test 3 Credential File Targeted Collection from Removable Media
windows

Simulates targeted collection of high-value credential files from removable media — the signature behavior of credential-harvesting implants like InvisiMole and OilRig tools that specifically target KeePass databases, private keys, and certificate files rather than performing broad sweeps. Uses PowerShell to selectively copy credential-bearing file types.

Command

powershell 
$fakeUSB = "$env:TEMP\sim_cred_usb"
New-Item -ItemType Directory -Path $fakeUSB -Force | Out-Null

# Create fake credential files
New-Item -Path "$fakeUSB\passwords.kdbx" -ItemType File | Out-Null
New-Item -Path "$fakeUSB\server.pfx" -ItemType File | Out-Null
New-Item -Path "$fakeUSB\id_rsa" -ItemType File | Out-Null
New-Item -Path "$fakeUSB\backup.key" -ItemType File | Out-Null

# Targeted credential collection (simulating stealer behavior)
$credExts = @('*.kdbx','*.pfx','*.pem','*.key','*.p12','*.ppk')
$stagingDir = "$env:TEMP\cred_harvest"
New-Item -ItemType Directory -Path $stagingDir -Force | Out-Null
foreach ($ext in $credExts) {
    Get-ChildItem -Path $fakeUSB -Filter $ext -Recurse -ErrorAction SilentlyContinue | Copy-Item -Destination $stagingDir
}

Cleanup

powershell 
Remove-Item -Recurse -Force "$env:TEMP\sim_cred_usb" -ErrorAction SilentlyContinue; Remove-Item -Recurse -Force "$env:TEMP\cred_harvest" -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: PowerShell process with Get-ChildItem filtering .kdbx/.pfx/.key extensions and Copy-Item to staging. Sysmon Event ID 11: File Create events for .kdbx, .pfx, id_rsa, .key in the staging directory. DeviceFileEvents: FileRead on credential-extension files. The credential-targeted hunting query will match immediately on file extensions.

Expected Detection

KQL hunting query 3 (credential-targeted) fires on any access to .kdbx, .pfx, .key, id_rsa files from a non-C: path. SPL credential hunting query matches the IsSensitive extension filter. Even below bulk threshold, these extensions trigger high-confidence escalation criteria.

Test 4 Robocopy Mirroring of Removable Media to Network Share
windows

Simulates exfiltration-oriented data collection where an adversary uses robocopy to mirror the entire contents of a USB drive to a network staging share — a technique observed in corporate espionage cases where insiders or compromised accounts with network access automate bulk transfer. Uses localhost as the 'network' destination to keep the test safe.

Command

powershell 
rem Setup simulated USB with mixed content
mkdir %TEMP%\robocopy_usb 2>nul
echo data > %TEMP%\robocopy_usb\report_q1.docx
echo data > %TEMP%\robocopy_usb\budget.xlsx
echo data > %TEMP%\robocopy_usb\notes.txt

rem Mirror entire USB to staging (simulating robocopy-based collection)
mkdir %TEMP%\robocopy_stage 2>nul
robocopy %TEMP%\robocopy_usb %TEMP%\robocopy_stage /E /COPYALL /R:0 /W:0 /LOG:%TEMP%\robocopy_collection.log

Cleanup

powershell 
rmdir /s /q %TEMP%\robocopy_usb 2>nul & rmdir /s /q %TEMP%\robocopy_stage 2>nul & del /f %TEMP%\robocopy_collection.log 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for robocopy.exe with source path, destination path, /E /COPYALL flags. Sysmon Event ID 11: File Create events for all mirrored files in staging directory. Sysmon Event ID 11: Log file creation (%TEMP%\robocopy_collection.log). DeviceFileEvents: robocopy.exe FileRead from source and FileCreated at destination.

Expected Detection

KQL SuspiciousProcessRemovableAccess fires on robocopy.exe (matched in suspicious process list). SPL detects robocopy.exe in the IsSuspiciousProcess eval. Hunting query 1 (burst pattern) fires on high file count within the time window. The /COPYALL and /LOG flags in the command line add additional suspicion context for analysts.

Related Detections

Tactic Hub

TA0009Collection

Related Techniques

T1091Replication Through Removable MediaT1119Automated CollectionT1074.001Local Data StagingT1560.001Archive via UtilityT1041Exfiltration Over C2 ChannelT1052.001Exfiltration over USBT1005Data from Local SystemT1039Data from Network Shared DriveT1057Process Discovery

Same Tactic: Collection

Popular Detections