T1092

Communication Through Removable Media

Command and Control Last updated:

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system. Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement via Replication Through Removable Media. Commands and files are relayed from the disconnected system to the Internet-connected system to which the adversary has direct access. This technique has been observed in APT28/Fancy Bear operations using CHOPSTICK and USBStealer malware to bridge air-gapped networks, writing encoded command files to USB drives on internet-connected hosts and reading results from the same media when re-inserted.

What is T1092 Communication Through Removable Media?

Communication Through Removable Media (T1092) maps to the Command and Control tactic — the adversary is trying to communicate with compromised systems to control them in MITRE ATT&CK.

This page provides production-ready detection logic for Communication Through Removable Media, covering the data sources and telemetry it touches: Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Command and Control
Technique
T1092 Communication Through Removable Media
Canonical reference
https://attack.mitre.org/techniques/T1092/
Microsoft Sentinel / Defender
kusto 
let RemovableDrivePaths = dynamic(["D:\\", "E:\\", "F:\\", "G:\\", "H:\\", "I:\\", "J:\\"]);
let SuspiciousExtensions = dynamic([".exe", ".dll", ".bat", ".cmd", ".ps1", ".vbs", ".js", ".hta", ".dat", ".bin"]);
let EncodedFilePatterns = dynamic([".enc", ".tmp", ".cfg", ".dat", ".bin", ".db"]);
// Branch 1: Executables or scripts written TO removable media
let ExecutablesOnUSB = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any (RemovableDrivePaths)
| where FileName has_any (SuspiciousExtensions)
| extend DetectionBranch = "ExecutableDroppedToUSB"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionBranch, SHA256;
// Branch 2: Processes EXECUTING from removable media (command execution on air-gapped side)
let ProcessFromUSB = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath has_any (RemovableDrivePaths) or ProcessCommandLine has_any (RemovableDrivePaths)
| where FileName !in~ ("setup.exe", "autorun.exe", "install.exe")
| extend DetectionBranch = "ProcessExecutedFromUSB"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionBranch, SHA256;
// Branch 3: Hidden or encoded data files written to USB (C2 data staging)
let DataFilesOnUSB = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any (RemovableDrivePaths)
| where FileName has_any (EncodedFilePatterns)
| where InitiatingProcessFileName !in~ ("explorer.exe", "robocopy.exe", "xcopy.exe", "backup.exe")
| extend DetectionBranch = "SuspiciousDataFileOnUSB"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionBranch, SHA256;
// Branch 4: USB device insertion followed by rapid file access (command pickup pattern)
let USBInsertionEvents = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "UsbDriveMounted"
| project DeviceName, MountTime=Timestamp;
let RapidUSBAccess = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has_any (RemovableDrivePaths)
| join kind=inner USBInsertionEvents on DeviceName
| where Timestamp between (MountTime .. (MountTime + 2m))
| where ActionType == "FileRead"
| extend DetectionBranch = "RapidFileReadAfterMount"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionBranch;
// Union all branches
union ExecutablesOnUSB, ProcessFromUSB, DataFilesOnUSB, RapidUSBAccess
| sort by Timestamp desc

Multi-branch detection for USB-based C2 communication patterns. Branch 1 identifies executables or scripts written to removable media (command staging). Branch 2 detects processes executing directly from USB drives (command execution on air-gapped side). Branch 3 finds hidden or encoded data files written to USB (C2 response staging). Branch 4 correlates USB insertion events with rapid file reads within 2 minutes (automated command pickup). Together these branches model the full APT28/USBStealer lifecycle of dropping commands, executing them on air-gapped hosts, and exfiltrating results via the same media.

high severity medium confidence

Data Sources

Drive: Drive Creation File: File Access File: File Creation Process: Process Creation Microsoft Defender for Endpoint

Required Tables

DeviceFileEvents DeviceProcessEvents DeviceEvents

False Positives

  • Software developers or IT staff who legitimately copy scripts or executables to USB drives for deployment on offline systems
  • Legitimate backup solutions that write encrypted backup archives to removable storage
  • Point-of-sale or industrial control system maintenance technicians who routinely deploy updates via USB in air-gapped environments
  • Users copying portable applications (PortableApps, SumatraPDF, etc.) to USB drives for personal use
  • Forensic investigators and incident responders who collect evidence or run analysis tools from USB media

Sigma rule & cross-platform mapping

The detection logic for Communication Through Removable Media (T1092) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1092 Sigma rules on detection.fyi

Platform-specific guides for T1092

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-13 Research depth: deep
References (6)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Stage Encoded Command File on USB Drive

    Expected signal: Sysmon Event ID 11 (FileCreate): TargetFilename=E:\system.dat, Image=powershell.exe. Sysmon Event ID 1 (Process Create): CommandLine containing 'Out-File' and 'E:\'. DeviceFileEvents in MDE: ActionType=FileCreated, FolderPath=E:\, FileName=system.dat, InitiatingProcessFileName=powershell.exe.

  2. Test 2Execute Payload from USB Drive

    Expected signal: Sysmon Event ID 1 (Process Create): Image=cmd.exe, CommandLine=cmd.exe /c E:\update.bat. Parent process is cmd.exe or the test shell. Sysmon Event ID 11: TargetFilename=E:\update.bat and E:\output.dat. Security Event ID 4688 (if command line auditing enabled): NewProcessName contains E:\update.bat. DeviceProcessEvents: FileName=cmd.exe, ProcessCommandLine contains 'E:\update.bat'.

  3. Test 3Automated USB File Pickup Simulation

    Expected signal: Multiple Sysmon Event ID 11 entries for file creation on E:\ by powershell.exe (cmd_*.dat and rsp_*.dat). Sysmon Event ID 1: PowerShell process with Get-Content and Out-File accessing removable drive. DeviceFileEvents: multiple FileCreated and FileRead actions on E:\ within a short time window — triggers the rapid-access-after-mount correlation branch.

  4. Test 4USB Device Serial Number Enumeration

    Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'USBSTOR' and 'Win32_DiskDrive'. Security Event ID 4663 (if object access auditing enabled on registry): access to HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. DeviceProcessEvents: PowerShell process accessing registry via Get-ItemProperty with USBSTOR path.

Response Playbook

Triage

  1. Identify the USB device: Review Event ID 6416 (Windows Security) or Sysmon EventID for device mount to extract the USB serial number, manufacturer, and product ID. Look this up in asset inventory — is it a corporate-managed device?
  2. Examine files written to the USB: Collect SHA256 hashes from DeviceFileEvents (KQL) or Sysmon Event ID 11 (SPL). Submit hashes to VirusTotal or your threat intel platform. Focus on executables, scripts (.ps1, .bat, .vbs), and suspiciously named .dat/.bin files.
  3. Check for processes executing FROM the USB: In DeviceProcessEvents, filter FolderPath or ProcessCommandLine containing the USB drive letter. Legitimate user installs typically come from named vendor folders (e.g., E:\SetupFiles\vendor_installer.exe). Unsigned or randomly named executables are high-priority.
  4. Review timing correlation: Did file creation on the USB occur within minutes of the device being mounted? Automated malware reads command files immediately on insertion — a sub-2-minute window between mount and file access is suspicious. Correlate DeviceEvents (mount) with DeviceFileEvents (read/write).
  5. Identify the initiating process: Which process wrote files to or read files from the USB? Explorer.exe suggests manual user action. A background service, scheduled task host, or unusual process (e.g., svchost with unexpected parameters, a renamed system binary) warrants immediate escalation.
  6. Check for air-gap indicators: Is the affected host on an isolated network segment, OT/ICS network, or classified network? Does it have restricted internet access? The risk profile changes dramatically for truly air-gapped systems — C2 over USB is the primary persistence and control mechanism in those environments.
  7. Review host history: Has this device shown prior USB-related detections? Has any recently executed process on this host also run on other hosts that had USB activity? Look for common payload hashes or process names across multiple endpoints.

Containment

  1. Physically secure the USB device if still present — do not allow the user to remove it. The device itself is evidence and may contain command history, C2 payloads, and exfiltrated data.
  2. Isolate the compromised host from the network using EDR network isolation or switch port shutdown. If this is the internet-connected relay host in a two-system C2 setup, isolation cuts the adversary's relay point.
  3. If a second compromised host (air-gapped target) has been identified, physically disconnect that system from power and preserve its state for forensic imaging. Do not allow further USB insertions.
  4. Block the USB device serial number via Group Policy (Computer Configuration > Administrative Templates > System > Removable Storage Access) or EDR USB control policy on all endpoints in the environment.
  5. Revoke and reset credentials for any accounts that logged into the affected hosts. USB-based C2 operations like APT28's CHOPSTICK often accompany credential theft.
  6. Preserve the USB drive as forensic evidence — create a bit-for-bit image using dd or FTK Imager before any analysis. The original device must remain unchanged for legal chain of custody.

Evidence Collection

  1. USB device artifacts — Windows: HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR (device history), HKLM\SYSTEM\CurrentControlSet\Enum\USB, setupapi.dev.log at C:\Windows\INF\setupapi.dev.log (device install timestamps)
  2. Shellbag and LNK artifacts — C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\ for LNK files pointing to removable drive paths; registry NTUSER.DAT ShellBags for browsed USB folder paths
  3. Windows Event Logs — Event ID 6416 (A new external device was recognized by the system) from Security log; Event ID 20001/20003 from Microsoft-Windows-DriverFrameworks-UserMode/Operational for device plug/unplug timestamps
  4. Sysmon Event ID 11 (FileCreate) logs filtered to USB drive letters for all files written to the device during the incident window
  5. Sysmon Event ID 1 (ProcessCreate) for any processes that executed from the USB drive path or accessed files on it
  6. Prefetch files at C:\Windows\Prefetch\ — if any executable ran from the USB, a prefetch file (FILENAME.EXE-XXXXXXXX.pf) exists with execution count and timestamps
  7. File system artifacts on the USB itself — recover deleted files using forensic tools (Autopsy, FTK). APT28's USBStealer and similar tools often delete command files after execution and write results to hidden or system-flagged locations.
  8. Memory forensic dump of the affected host — if malware is still running in memory, a full RAM capture (via WinPMEM, Magnet RAM Capture, or EDR memory acquisition) may reveal C2 payloads, decryption keys, and in-memory command queues

Escalation Criteria

  • ! Any executable or script file found on the USB that is unsigned, has a low prevalence rate (<5 machines globally in Defender telemetry), or matches a known malware hash (APT28 CHOPSTICK, USBStealer) — escalate immediately to IR team
  • ! Evidence of two compromised hosts: one internet-connected and one on an isolated/OT network segment, with the same USB device serial number appearing in logs for both — this is the textbook T1092 scenario
  • ! Files on the USB with encrypted or encoded content (Base64, XOR, custom encoding) that do not correspond to known legitimate software — indicates active C2 command/response channel
  • ! Processes executing from the USB drive path that are not user-initiated (no explorer.exe parent, spawned by a system service or scheduled task) — indicates automated malware execution
  • ! The affected host resides in a sensitive network segment (ICS/SCADA, classified, financial clearing, healthcare), as USB-based C2 specifically targets these environments
  • ! Multiple hosts showing the same USB device serial number in their device history — indicates the adversary is physically moving the device between systems (classic air-gap bridging)

Investigation Guide

Forensic Artifacts

  • > Registry: HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR — complete history of all USB storage devices ever connected, including serial numbers, manufacturer, and first/last connection timestamps (via registry timestamps)
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Enum\USB — raw USB device entries including VID/PID for device identification
  • > Registry: HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices — friendly names and GUIDs for connected portable devices
  • > File System: C:\Windows\INF\setupapi.dev.log — device installation log with timestamps for every USB device ever connected
  • > File System: C:\Windows\Prefetch\*.pf — if malware executed from USB, prefetch entries reveal execution timestamps and loaded modules
  • > File System: C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\*.lnk — LNK shortcut files created when user accessed files on USB; contain target path, volume serial number, MAC timestamps
  • > File System: C:\Users\<user>\AppData\Local\Microsoft\Windows\UsrClass.dat (ShellBags) — records browsed USB folder paths even after device removal
  • > Event Log: Microsoft-Windows-DriverFrameworks-UserMode/Operational — Event IDs 2003/2100/2101 for device connect/disconnect with precise timestamps
  • > Event Log: Windows Security Event ID 6416 — external device first recognized by system
  • > USB device itself: MFT ($MFT), $LogFile, $UsnJrnl — change journal reveals all file create/modify/delete operations on the USB; deleted command files may be recoverable from unallocated space

Tuning Guidance

T1092 detection requires baseline knowledge of legitimate USB usage in your environment. Start by enumerating all authorized USB devices via USBSTOR registry keys and correlating against your asset management system. Organizations using removable media for legitimate operational reasons (OT/ICS update procedures, air-gapped classified systems, medical device updates) will have high false positive rates without allowlisting specific device serial numbers and the processes that interact with them. Key tuning steps: (1) Allowlist known-good USB device serial numbers from USBSTOR; exclude their activity from alerting while retaining logging. (2) Allowlist specific initiating processes that legitimately write to USB — e.g., robocopy.exe, xcopy.exe for backup workflows, vendor-specific updater executables for OT environments. (3) Focus detection energy on executable and script files written to USB rather than data files — benign USB usage is overwhelmingly document/media files. (4) Raise alert priority for any unsigned executable found on USB with a PE compile timestamp within 30 days — freshly compiled malware is a strong indicator. (5) For organizations with truly air-gapped environments, deploy a dedicated monitoring solution on the air-gapped network that tracks USB device serial numbers and correlates them with the internet-connected monitoring data — shared device serial numbers across network boundaries are a definitive T1092 indicator. Confidence is set to medium because USB activity is common and the C2 commands themselves are indistinguishable from legitimate file copies without behavioral context.

Hunting Queries

Hunt for USB drive letter references appearing in process command lines across multiple hosts. A single USB device serial number appearing in device history on more than one host — combined with processes accessing that drive letter — identifies the physical transport path of C2 traffic. Multiple hosts accessing the same drive letter from non-standard processes is a strong indicator of the USB relay chain.

Hunting — KQL
kql 
// Hunt for USB drive letters appearing in process command lines across the environment
// Identifies hosts where processes have interacted with USB paths — pivot point for C2 relay identification
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine matches regex @"[D-Hd-h]:\\\\[^\s]{3,}"
| where FileName !in~ ("explorer.exe", "msiexec.exe", "setup.exe", "install.exe")
| extend DriveLetter = extract(@"([D-Hd-h]):\\\\", 1, ProcessCommandLine)
| summarize HostCount=dcount(DeviceName), Hosts=make_set(DeviceName), CommandLines=make_set(ProcessCommandLine), Earliest=min(Timestamp), Latest=max(Timestamp) by FileName, DriveLetter, AccountName
| where HostCount > 1
| sort by HostCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| rex field=CommandLine "(?i)(?P<DriveLetter>[D-H]):\\\\"
| where isnotnull(DriveLetter)
| where NOT match(Image, "(?i)(explorer\.exe|msiexec\.exe|setup\.exe|install\.exe)$")
| stats dc(host) as HostCount, values(host) as Hosts, values(CommandLine) as CommandLines, earliest(_time) as Earliest, latest(_time) as Latest by Image, DriveLetter, User
| where HostCount > 1
| sort - HostCount

Hunt for file operation bursts on removable media within a 5-minute window. USB-based C2 malware like USBStealer operates automatically on device insertion — reading command files and writing response data in rapid succession. Three or more file operations on a USB drive within 5 minutes of mount by non-user-interactive processes is highly indicative of automated malware behavior.

Hunting — KQL
kql 
// Hunt for file creation bursts on USB drives within 5 minutes of device mount
// Models the automated 'pickup and drop' behavior of USBStealer/CHOPSTICK-style malware
let MountEvents = DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "UsbDriveMounted"
| project DeviceName, MountTime=Timestamp, DriveLetter=AdditionalFields;
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in ("FileCreated", "FileModified", "FileRead")
| where FolderPath matches regex @"^[D-Hd-h]:\\\\"
| join kind=inner MountEvents on DeviceName
| where Timestamp between (MountTime .. (MountTime + 5m))
| summarize FileOps=count(), Files=make_set(FileName), Processes=make_set(InitiatingProcessFileName) by DeviceName, MountTime, AccountName
| where FileOps >= 3
| sort by FileOps desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| rex field=TargetFilename "^(?P<DriveLetter>[D-H]):\\\\"
| where isnotnull(DriveLetter)
| bin _time span=5m
| stats count as FileOps, values(TargetFilename) as Files, values(Image) as Processes by host, DriveLetter, _time
| where FileOps >= 3
| sort - FileOps

Hunt for non-standard processes writing files to USB drives — specifically processes NOT located in C:\Windows or C:\Program Files. The internet-connected staging host in a T1092 operation runs the C2 relay malware from user-space or temp directories. This query surfaces the process tree and binary location to identify the staging malware, which is distinct from the payload dropped onto the USB for the air-gapped target.

Hunting — KQL
kql 
// Hunt for processes writing files to USB that are themselves running from unusual locations
// Identifies the internet-connected staging host that drops commands onto the USB
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileCreated"
| where FolderPath matches regex @"^[D-Hd-h]:\\\\"
| where InitiatingProcessFolderPath !startswith @"C:\Windows"
| where InitiatingProcessFolderPath !startswith @"C:\Program Files"
| where InitiatingProcessFolderPath !startswith @"C:\Program Files (x86)"
| where InitiatingProcessFileName !in~ ("explorer.exe", "cmd.exe", "robocopy.exe", "xcopy.exe")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, SHA256
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| rex field=TargetFilename "^(?P<DriveLetter>[D-H]):\\\\"
| where isnotnull(DriveLetter)
| where NOT match(Image, "(?i)(explorer\.exe|cmd\.exe|robocopy\.exe|xcopy\.exe)$")
| where NOT match(Image, "(?i)^[Cc]:\\\\(Windows|Program Files|Program Files \(x86\))\\\\") 
| table _time, host, User, TargetFilename, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Atomic Red Team Tests

Test 1 Stage Encoded Command File on USB Drive
windows

Simulates the internet-connected host side of T1092: encodes a command string in Base64 and writes it as a .dat file to a removable drive. This models APT28/USBStealer behavior where C2 commands are encoded and dropped to USB for pickup by the air-gapped target's malware component. Requires a USB drive mounted at E:\ (adjust drive letter as needed).

Command

powershell 
$command = 'whoami /all; ipconfig /all; net user'
$encoded = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($command))
$encoded | Out-File -FilePath 'E:\system.dat' -Encoding ASCII -NoNewline
Write-Output "Command staged at E:\system.dat ($(($encoded).Length) bytes)"

Cleanup

powershell 
Remove-Item 'E:\system.dat' -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 (FileCreate): TargetFilename=E:\system.dat, Image=powershell.exe. Sysmon Event ID 1 (Process Create): CommandLine containing 'Out-File' and 'E:\'. DeviceFileEvents in MDE: ActionType=FileCreated, FolderPath=E:\, FileName=system.dat, InitiatingProcessFileName=powershell.exe.

Expected Detection

Triggers DataFileOnUSB branch (KQL) and DataFileOnUSB eval=1 (SPL) due to .dat file creation on USB drive by PowerShell. Also triggers SuspiciousDataFileOnUSB branch in union query. SuspicionScore >= 1 in SPL.

Test 2 Execute Payload from USB Drive
windows

Simulates the air-gapped host side of T1092: executes a script placed on a USB drive. This models the execution step where malware on the isolated host reads and executes commands from the USB media. Creates a benign test script on USB and executes it via cmd.exe to generate realistic process creation telemetry.

Command

powershell 
echo @echo off > E:\update.bat
echo whoami >> E:\update.bat
echo hostname >> E:\update.bat
echo ipconfig >> E:\update.bat
cmd.exe /c E:\update.bat > E:\output.dat 2>&1
type E:\output.dat

Cleanup

powershell 
del E:\update.bat E:\output.dat 2>nul

Expected Telemetry

Sysmon Event ID 1 (Process Create): Image=cmd.exe, CommandLine=cmd.exe /c E:\update.bat. Parent process is cmd.exe or the test shell. Sysmon Event ID 11: TargetFilename=E:\update.bat and E:\output.dat. Security Event ID 4688 (if command line auditing enabled): NewProcessName contains E:\update.bat. DeviceProcessEvents: FileName=cmd.exe, ProcessCommandLine contains 'E:\update.bat'.

Expected Detection

Triggers ProcessFromUSB branch (KQL) matching ProcessCommandLine containing 'E:\'. Triggers ExecutableOnUSB eval=1 (SPL) for the cmd.exe execution with USB path. Also triggers ScriptOnUSB for the .bat file creation. Detection branch ExecutableDroppedToUSB fires for the .bat file write.

Test 3 Automated USB File Pickup Simulation
windows

Simulates the automated command-pickup behavior of USBStealer-style malware: monitors for a file appearing on a USB drive and reads it automatically within seconds of detection. This replicates the WMI-based or polling-based file monitoring that APT28 malware uses to detect when the USB is inserted and immediately retrieve command files.

Command

powershell 
$driveLetter = 'E'
$commandFile = "${driveLetter}:\cmd_$(Get-Random).dat"
# Simulate malware polling loop (runs 3 iterations)
for ($i = 0; $i -lt 3; $i++) {
  if (Test-Path $commandFile) {
    $content = Get-Content $commandFile -Raw
    Write-Output "[+] Command retrieved: $content"
    # Simulate writing response back to USB
    "Result-$(hostname)-$(Get-Date -Format yyyyMMddHHmmss)" | Out-File "${driveLetter}:\rsp_$(Get-Random).dat"
    Remove-Item $commandFile -Force
    break
  }
  Write-Output "[-] Polling iteration $i — no command file found"
  Start-Sleep -Seconds 2
}
# Create the command file to trigger pickup on next poll
"whoami" | Out-File $commandFile

Cleanup

powershell 
Get-ChildItem 'E:\' -Filter 'rsp_*.dat' | Remove-Item -Force
Get-ChildItem 'E:\' -Filter 'cmd_*.dat' | Remove-Item -Force

Expected Telemetry

Multiple Sysmon Event ID 11 entries for file creation on E:\ by powershell.exe (cmd_*.dat and rsp_*.dat). Sysmon Event ID 1: PowerShell process with Get-Content and Out-File accessing removable drive. DeviceFileEvents: multiple FileCreated and FileRead actions on E:\ within a short time window — triggers the rapid-access-after-mount correlation branch.

Expected Detection

Triggers RapidFileReadAfterMount branch (KQL) if USB was recently mounted. Triggers DataFileOnUSB for .dat file writes. SPL: DataFileOnUSB=1, SuspicionScore >= 1. The burst of file operations (3+ within minutes) triggers the hunting query for file operation bursts on USB.

Test 4 USB Device Serial Number Enumeration
windows

Simulates reconnaissance of the local host's USB history — an adversary on the internet-connected relay host may enumerate previously connected USB devices to identify the serial number of their chosen exfiltration medium and confirm it matches between victim systems. This is pre-operational reconnaissance for establishing the T1092 relay chain.

Command

powershell 
# Enumerate all USB storage devices from registry
Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\*' |
  Select-Object PSChildName, FriendlyName, @{N='SerialNumber';E={($_.PSChildName -split '&')[0]}} |
  Format-Table -AutoSize

# Also check via WMI for currently connected devices
Get-WmiObject Win32_DiskDrive | Where-Object {$_.InterfaceType -eq 'USB'} |
  Select-Object DeviceID, Model, SerialNumber, Size |
  Format-Table -AutoSize

Expected Telemetry

Sysmon Event ID 1: powershell.exe with CommandLine containing 'USBSTOR' and 'Win32_DiskDrive'. Security Event ID 4663 (if object access auditing enabled on registry): access to HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. DeviceProcessEvents: PowerShell process accessing registry via Get-ItemProperty with USBSTOR path.

Expected Detection

This activity is detected by Process creation telemetry (Sysmon EID 1) showing PowerShell accessing USBSTOR registry key. While not directly in the main detection query, this feeds the hunting query for non-standard processes examining USB device history. Correlate with subsequent USB file operations to identify the full attack chain.

Related Detections

Tactic Hub

TA0011Command and Control

Related Techniques

T1091Replication Through Removable MediaT1052Exfiltration Over Physical MediumT1052.001Exfiltration over USBT1027Obfuscated Files or InformationT1025Data from Removable MediaT1074.001Local Data StagingT1059.001PowerShellT1547.001Registry Run Keys / Startup FolderT1005Data from Local System

Same Tactic: Command and Control

Popular Detections