Data Exfiltration via USB Removable Media

let SensitivePaths = dynamic(["C:\\Finance", "C:\\HR", "C:\\Users\\Public\\Confidential", "\\Shares\\Legal", "\\Shares\\Engineering"]);
// Signal 1: Removable storage device plugged in (DeviceEvents PnP/USB events)
let UsbArrival = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("PnpDeviceConnected", "UsbDriveMounted")
| project Timestamp, DeviceName, DeviceId=AdditionalFields, ArrivalTime=Timestamp;
// Signal 2: High volume file copy operations to a removable drive shortly after arrival
let FileCopySignal = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath matches regex @"^[D-Z]:\\" // non-system drive letters commonly assigned to removable media
| where FolderPath has_any (SensitivePaths) or InitiatingProcessFolderPath has_any (SensitivePaths)
| summarize FileCount=count(), TotalSizeBytes=sum(FileSize), Files=make_set(FileName, 20) by DeviceName, AccountName=InitiatingProcessAccountName, bin(Timestamp, 5m)
| where FileCount > 20 or TotalSizeBytes > 52428800
| extend Signal = "BulkCopyToRemovableMedia";
UsbArrival
| join kind=inner (FileCopySignal) on DeviceName
| where FileCopySignal.Timestamp between (ArrivalTime .. ArrivalTime + 30m)
| project Timestamp, DeviceName, AccountName, Signal, FileCount, TotalSizeBytes, Files
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-DriverFrameworks-UserMode/Operational" EventCode=2003
| eval ArrivalTime=_time
| table Computer, ArrivalTime
| join type=inner Computer
  [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
    (TargetFilename="D:\\*" OR TargetFilename="E:\\*" OR TargetFilename="F:\\*" OR TargetFilename="G:\\*")
    | bin _time span=5m
    | stats count as FileCount, values(TargetFilename) as Files, dc(TargetFilename) as UniqueFiles by Computer, User, _time
    | where FileCount > 20
    | rename _time as CopyTime ]
| where CopyTime >= ArrivalTime AND CopyTime <= ArrivalTime + 1800
| table ArrivalTime, CopyTime, Computer, User, FileCount, Files
| sort - CopyTime

sequence by host.name with maxspan=30m
  [any where event.category == "driver" and event.action : ("device-connected", "usb-drive-mounted")]
  [file where event.type == "creation" and
   file.path : ("D:\\*", "E:\\*", "F:\\*", "G:\\*")]
| stats count() by host.name, user.name

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  "Computer" AS Hostname,
  username AS UserName,
  QIDNAME(qid) AS EventName,
  "TargetFilename" AS TargetFile,
  COUNT(*) AS FileWriteCount
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND starttime > NOW() - 1 DAYS
  AND (
    ("TargetFilename" ILIKE 'D:\%' OR "TargetFilename" ILIKE 'E:\%' OR "TargetFilename" ILIKE 'F:\%' OR "TargetFilename" ILIKE 'G:\%')
    AND qid IN (SELECT qid FROM QID WHERE name ILIKE '%sysmon event 11%' OR name ILIKE '%file create%')
  )
GROUP BY "Computer", username, "TargetFilename"
HAVING COUNT(*) > 20
ORDER BY starttime DESC

(_sourceCategory="windows/sysmon" OR _sourceCategory="siem/windows/sysmon")
| parse "EventID>*<" as EventID nodrop
| parse "TargetFilename>*<" as TargetFilename nodrop
| parse "User>*<" as User nodrop
| parse "Computer>*<" as Computer nodrop
| where EventID = "11"
| where TargetFilename matches "D:\\*" OR TargetFilename matches "E:\\*" OR TargetFilename matches "F:\\*" OR TargetFilename matches "G:\\*"
| timeslice 5m
| count as FileCount by Computer, User, _timeslice
| where FileCount > 20
| sort by FileCount desc

rule threat_exfil_usb_removable_media {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects bulk file copy activity to a non-system drive letter shortly after removable media arrival, indicating T1052.001 - Exfiltration Over USB"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1052.001"
    severity = "HIGH"
    confidence = "MEDIUM"
    reference = "https://attack.mitre.org/techniques/T1052/001/"
    version = "1.0"
    created = "2026-07-15"

  events:
    $e1.metadata.event_type = "FILE_CREATION"
    AND $e1.target.file.full_path = /(?i)^[D-G]:\\/

  match:
    $e1.principal.hostname over 5m

  condition:
    #e1 > 20
}

#repo="base_sensor"
#event_simpleName="FileWritten"
| TargetFileName = /(?i)^[D-G]:\\/
| bucket span=5m
| groupBy([ComputerName, UserName, _bucket], function=[count(as=FileCount)])
| where FileCount > 20
| sort(FileCount, order=desc, limit=1000)