T1025

Data from Removable Media

Collection

Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to exfiltration. Threat actors including APT28, Gamaredon Group, and OilRig have leveraged this technique. Malware families such as USBStealer, GravityRAT, Rover, Crimson, Crutch, and BADNEWS implement automated USB harvesting — copying files matching predefined extension lists (documents, credentials, archives) to staging directories for later exfiltration.

Microsoft Sentinel / Defender
kusto 
let SensitiveExtensions = dynamic([".doc", ".docx", ".xls", ".xlsx", ".pdf", ".ppt", ".pptx",
  ".txt", ".csv", ".kdbx", ".pfx", ".pem", ".key", ".p12", ".zip", ".rar", ".7z",
  ".bak", ".sql", ".db", ".sqlite", ".conf", ".config", ".xml", ".json"]);
let LookbackWindow = 1h;
let BulkAccessThreshold = 20;
// Branch 1: Bulk file reads from removable media paths
let BulkRemovableAccess =
DeviceFileEvents
| where Timestamp > ago(LookbackWindow)
| where ActionType in ("FileRead", "FileCopied", "FileCreated")
| where FolderPath matches regex @"(?i)^[D-Z]:\\"
| where not(FolderPath has_any ("C:\\Windows", "C:\\Program Files", "C:\\ProgramData", "C:\\Users"))
| extend FileExt = tolower(tostring(split(FileName, ".")[-1]))
| extend FullExt = strcat(".", FileExt)
| where FullExt in (SensitiveExtensions)
| summarize
    FileCount = count(),
    UniqueExtensions = dcount(FileExt),
    FileList = make_set(FileName, 10),
    FolderList = make_set(FolderPath, 5),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where FileCount >= BulkAccessThreshold
| extend DetectionType = "BulkRemovableMediaAccess"
| extend RiskScore = case(
    FileCount >= 100, "Critical",
    FileCount >= 50, "High",
    FileCount >= 20, "Medium",
    "Low");
// Branch 2: Suspicious process accessing removable media paths
let SuspiciousRemovableProcessAccess =
DeviceFileEvents
| where Timestamp > ago(LookbackWindow)
| where ActionType in ("FileRead", "FileCopied", "FileCreated")
| where FolderPath matches regex @"(?i)^[D-Z]:\\"
| where not(FolderPath has_any ("C:\\Windows", "C:\\Program Files", "C:\\ProgramData", "C:\\Users"))
| where InitiatingProcessFileName in~ (
    "powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "rundll32.exe", "python.exe", "python3.exe",
    "xcopy.exe", "robocopy.exe", "forfiles.exe"
    )
    or InitiatingProcessCommandLine has_any ("xcopy", "robocopy", "copy", "Get-ChildItem", "Copy-Item", "dir ")
| summarize
    FileCount = count(),
    FileList = make_set(FileName, 10),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where FileCount >= 5
| extend DetectionType = "SuspiciousProcessRemovableAccess"
| extend RiskScore = "High";
// Union results
BulkRemovableAccess
| project Timestamp=LastSeen, DeviceName, AccountName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, FileCount, FileList, FolderList, DetectionType, RiskScore
| union (
    SuspiciousRemovableProcessAccess
    | project Timestamp=LastSeen, DeviceName, AccountName, InitiatingProcessFileName,
        InitiatingProcessCommandLine, FileCount, FileList, FolderList=dynamic([]), DetectionType, RiskScore
)
| sort by Timestamp desc
high severity medium confidence

Data Sources

File: File Access File: File Read Microsoft Defender for Endpoint Process: Process Creation

Required Tables

DeviceFileEvents

False Positives

  • Legitimate backup software (Acronis, Veeam, Windows Backup) reading files from external USB drives or backup volumes assigned non-C: drive letters
  • Software developers or IT staff intentionally copying project files from USB drives for deployment or archiving
  • CD/DVD optical drives assigned D: or E: letters accessed for legitimate software installation or media playback
  • Secondary internal hard drives or partitions assigned drive letters in the D-Z range during normal file access or synchronization
  • Automated DLP (Data Loss Prevention) agents that perform file scanning on all connected drives as part of policy enforcement
Last updated: 2026-04-13 Research depth: deep
References (10)

Unlock Pro Content

Get the full detection package for T1025 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Same Tactic: Collection

Popular Detections