Detect Exfiltration over USB in Sumo Logic CSE
Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems. Threat actors including APT30 (SPACESHIP), ProjectSauron (Remsec), APT28 (USBStealer), Tropic Trooper, Mustang Panda, and malware families like Agent.btz and Machete have all used USB-based exfiltration techniques.
MITRE ATT&CK
- Tactic
- Exfiltration
- Technique
- T1052 Exfiltration Over Physical Medium
- Sub-technique
- T1052.001 Exfiltration over USB
- Canonical reference
- https://attack.mitre.org/techniques/T1052/001/
Sumo Detection Query
(_sourceCategory=Windows* OR _sourceCategory=sysmon* OR _sourceCategory=WinEventLog*)
| where EventCode in ("6416", "11", "20001")
| eval is_usb_insert = if(EventCode in ("6416", "20001") and (
toLowerCase(DeviceDescription) matches ".*usb.*" or
toLowerCase(DeviceDescription) matches ".*removable.*" or
toLowerCase(DeviceDescription) matches ".*flash.*"
), 1, 0)
| eval is_file_copy = if(EventCode == "11" and (
TargetFilename matches "[D-Jd-j]:\\\\.*"
), 1, 0)
| eval is_sensitive_ext = if(EventCode == "11" and
toLowerCase(TargetFilename) matches ".*\\.(zip|rar|7z|tar|gz|docx?|xlsx?|pptx?|pdf|csv|db|kdbx|pfx|pem|key)$", 1, 0)
| where is_usb_insert == 1 or (is_file_copy == 1 and is_sensitive_ext == 1)
| stats
sum(is_usb_insert) as usb_inserts,
sum(is_file_copy) as files_copied,
count_distinct(TargetFilename) as unique_files,
values(TargetFilename) as file_samples
by _sourceHost, user
| where files_copied >= 5
| eval has_usb_event = if(usb_inserts > 0, "YES", "NO")
| eval risk_score = if(files_copied >= 50 and usb_inserts > 0, 90,
if(files_copied >= 20 and usb_inserts > 0, 75,
if(files_copied >= 5 and usb_inserts > 0, 60,
if(files_copied >= 20, 55, 40))))
| fields _sourceHost, user, usb_inserts, files_copied, unique_files, file_samples, has_usb_event, risk_score
| sort by risk_score descSumo Logic query over Windows Security and Sysmon log source categories, identifying USB device insertion events (EventCode 6416, 20001) and Sysmon FileCreate events (EventCode 11) targeting removable drive letters D-J with sensitive file extensions. Aggregates per host and user, enforces a 5-file minimum, and computes a risk score that escalates when USB insertion is correlated with the file writes.
Data Sources
Required Tables
False Positives & Tuning
- Security operations staff running authorized forensic data collection that involves copying evidence archives to encrypted USB drives as part of an incident response chain-of-custody procedure
- Software QA engineers using removable USB media to stage compressed application packages or firmware images for transfer to physically isolated test benches
- Employees in organizations that permit portable encrypted USB drives (e.g., IronKey, Apricorn) for approved document transport between offices or to client sites
Other platforms for T1052.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Manual File Copy to USB Drive via xcopy
Expected signal: Sysmon Event ID 11 (FileCreated): Multiple file creation events with TargetFilename starting with E:\ and InitiatingProcessFileName=xcopy.exe. Sysmon Event ID 1 (ProcessCreate): xcopy.exe process creation with command line referencing TEMP and E: drive. Security Event ID 4663 (if object access auditing enabled): File access on source files.
- Test 2PowerShell Automated File Staging and USB Copy
Expected signal: Sysmon Event ID 1 (ProcessCreate): powershell.exe with -ExecutionPolicy Bypass flag. Sysmon Event ID 11 (FileCreated): 6 file creation events under E:\.hidden_sync\ with various sensitive extensions. PowerShell ScriptBlock Log Event ID 4104: Full script content including drive path and file names. Security Event ID 6416 (if auditing enabled): may correlate with prior USB insertion.
- Test 3Create Agent.btz-style thumb.dd Artifact on USB
Expected signal: Sysmon Event ID 11 (FileCreated): TargetFilename=E:\thumb.dd, InitiatingProcessFileName=powershell.exe. PowerShell ScriptBlock Log Event ID 4104: Script showing system information collection and file write to USB path. Security Event ID 4688: Process creation for powershell.exe.
- Test 4Robocopy Bulk Transfer to Removable Drive with Mirror
Expected signal: Sysmon Event ID 1 (ProcessCreate): robocopy.exe with MIR flag targeting E: drive. Sysmon Event ID 11 (FileCreated): 10+ file creation events under E:\backup_sync\. Security Event ID 4688: robocopy.exe process creation with full command line (if process command line auditing enabled via GPO).
References (12)
- https://attack.mitre.org/techniques/T1052/001/
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt30.pdf
- https://securelist.com/faq-the-projectsauron-apt/75533/
- https://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/
- https://www.trendmicro.com/en_us/research/20/e/tropic-trooper-s-back-usbferry-attack-targets-air-gapped-environments.html
- https://www.avira.com/en/blog/mustang-panda-threat-actor-is-adding-new-techniques-to-its-arsenal
- https://securelist.com/agent-btz-a-source-of-inspiration/58551/
- https://www.welivesecurity.com/2019/08/05/machete-just-got-sharper-venezuelan-government-institutions-under-attack/
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-pnp-activity
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1052.001/T1052.001.md
- https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-key-security-and-access-rights
- https://www.sans.org/blog/investigating-usb-drive-forensics-on-windows/
Unlock Pro Content
Get the full detection package for T1052.001 including response playbook, investigation guide, and atomic red team tests.