Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for T1052.001.
Upgrade to ProDetect Exfiltration over USB in Microsoft Sentinel
Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems. Threat actors including APT30 (SPACESHIP), ProjectSauron (Remsec), APT28 (USBStealer), Tropic Trooper, Mustang Panda, and malware families like Agent.btz and Machete have all used USB-based exfiltration techniques.
MITRE ATT&CK
- Tactic
- Exfiltration
- Technique
- T1052 Exfiltration Over Physical Medium
- Sub-technique
- T1052.001 Exfiltration over USB
- Canonical reference
- https://attack.mitre.org/techniques/T1052/001/
KQL Detection Query
// Detect USB device insertion and subsequent large-scale file copy activity
let SuspiciousExtensions = dynamic([".zip", ".rar", ".7z", ".tar", ".gz", ".docx", ".xlsx", ".pdf", ".pptx", ".doc", ".xls", ".csv", ".db", ".kdbx", ".pfx", ".pem", ".key"]);
let USBDrivePaths = dynamic(["D:\\", "E:\\", "F:\\", "G:\\", "H:\\", "I:\\", "J:\\"]);
// Part 1: Detect file writes to removable drive paths
let FileCopyToUSB = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any (USBDrivePaths)
| where FileName has_any (SuspiciousExtensions)
| summarize FilesCopied=count(), FileSizeMB=sum(FileSize)/1048576, FileSample=make_set(FileName, 10), EarliestCopy=min(Timestamp), LatestCopy=max(Timestamp)
by DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where FilesCopied >= 5
| extend AlertReason = "Bulk file copy to removable drive path";
// Part 2: Detect USB device arrival events via PnP logs
let USBDeviceEvents = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "PnpDeviceConnected"
| where AdditionalFields has "USB"
| extend DeviceClass = tostring(parse_json(AdditionalFields).ClassName)
| extend DeviceDesc = tostring(parse_json(AdditionalFields).DeviceDescription)
| where DeviceClass in~ ("DiskDrive", "USB", "USBSTOR") or DeviceDesc has_any ("USB", "Flash", "Removable")
| project Timestamp, DeviceName, AccountName, DeviceClass, DeviceDesc;
// Part 3: Correlate USB arrival with subsequent file copies
FileCopyToUSB
| join kind=leftouter (
USBDeviceEvents
| project DeviceName, USBInsertTime=Timestamp, DeviceClass, DeviceDesc
) on DeviceName
| where isempty(USBInsertTime) or (EarliestCopy >= USBInsertTime and EarliestCopy <= USBInsertTime + 1h)
| project EarliestCopy, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine,
FilesCopied, FileSizeMB, FileSample, USBInsertTime, DeviceDesc, AlertReason
| sort by FilesCopied descDetects potential USB exfiltration by correlating USB device connection events (PnpDeviceConnected) with bulk file copy activity to removable drive paths. Flags cases where 5 or more sensitive files (documents, archives, keys) are written to drive letters commonly assigned to removable media. Also joins USB insertion events to identify when a device was connected shortly before file copies began. Covers techniques used by SPACESHIP, Remsec, USBStealer, Machete, and Agent.btz.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate IT asset backup operations copying files to external drives for archival or disaster recovery
- Software developers copying build artifacts or source code to USB drives for air-gapped deployment
- Users performing authorized transfers of their own work files to external media per company policy
- Automated backup software (e.g., Windows Backup, third-party tools) that writes to removable drives on a schedule
Other platforms for T1052.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Manual File Copy to USB Drive via xcopy
Expected signal: Sysmon Event ID 11 (FileCreated): Multiple file creation events with TargetFilename starting with E:\ and InitiatingProcessFileName=xcopy.exe. Sysmon Event ID 1 (ProcessCreate): xcopy.exe process creation with command line referencing TEMP and E: drive. Security Event ID 4663 (if object access auditing enabled): File access on source files.
- Test 2PowerShell Automated File Staging and USB Copy
Expected signal: Sysmon Event ID 1 (ProcessCreate): powershell.exe with -ExecutionPolicy Bypass flag. Sysmon Event ID 11 (FileCreated): 6 file creation events under E:\.hidden_sync\ with various sensitive extensions. PowerShell ScriptBlock Log Event ID 4104: Full script content including drive path and file names. Security Event ID 6416 (if auditing enabled): may correlate with prior USB insertion.
- Test 3Create Agent.btz-style thumb.dd Artifact on USB
Expected signal: Sysmon Event ID 11 (FileCreated): TargetFilename=E:\thumb.dd, InitiatingProcessFileName=powershell.exe. PowerShell ScriptBlock Log Event ID 4104: Script showing system information collection and file write to USB path. Security Event ID 4688: Process creation for powershell.exe.
- Test 4Robocopy Bulk Transfer to Removable Drive with Mirror
Expected signal: Sysmon Event ID 1 (ProcessCreate): robocopy.exe with MIR flag targeting E: drive. Sysmon Event ID 11 (FileCreated): 10+ file creation events under E:\backup_sync\. Security Event ID 4688: robocopy.exe process creation with full command line (if process command line auditing enabled via GPO).
References (9)
- https://attack.mitre.org/techniques/T1052/001/
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt30.pdf
- https://securelist.com/faq-the-projectsauron-apt/75533/
- https://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/
- https://securelist.com/agent-btz-a-source-of-inspiration/58551/
- https://www.welivesecurity.com/2019/08/05/machete-just-got-sharper-venezuelan-government-institutions-under-attack/
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-pnp-activity
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1052.001/T1052.001.md
- https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-key-security-and-access-rights
Unlock playbooks & atomic tests with Pro
Get the full detection package for T1052.001 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-Exfil-USBRemovableMediaData Exfiltration via USB Removable MediaUse for insider bulk copy — large volumes moved from sensitive paths onto removable media.
- THREAT-USB-AirGapBridgingAir-Gap Bridging Exfiltration via Shared USB MediaUse for air-gap bridging — the same USB serial appearing across segmented hosts, plus Agent.btz/USBStealer markers.