Detect Data Exfiltration via USB Removable Media in Elastic Security
Adversaries and malicious insiders may copy sensitive files to a USB removable drive to exfiltrate data outside of network-monitored channels, bypassing DLP and network-based egress controls entirely. This is especially relevant in air-gapped or high-security environments where physical media is the only viable exfiltration path. Detection combines removable-storage device arrival events with high-volume file-copy activity from sensitive directories to the newly mounted volume within a short window.
MITRE ATT&CK
- Tactic
- Exfiltration
Elastic Detection Query
sequence by host.name with maxspan=30m
[any where event.category == "driver" and event.action : ("device-connected", "usb-drive-mounted")]
[file where event.type == "creation" and
file.path : ("D:\\*", "E:\\*", "F:\\*", "G:\\*")]
| stats count() by host.name, user.nameDetects a removable storage device connection event followed within 30 minutes by file creation activity on a non-system drive letter, indicating potential bulk data movement onto USB media. Maps to MITRE ATT&CK T1052.001.
Data Sources
Required Tables
False Positives & Tuning
- Authorized IT imaging or provisioning tasks copying files to removable media
- Approved offline backup workflows using encrypted removable drives
- Media/creative teams transferring large asset files to portable storage for delivery
Other platforms for THREAT-Exfil-USBRemovableMedia
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Bulk File Copy to Removable Drive via PowerShell
Expected signal: Sysmon Event ID 11: 30 FileCreate events with TargetFilename under E:\ within a few seconds. Windows Event ID 2003/2100 (or DeviceEvents UsbDriveMounted) showing the E: volume was previously connected. DeviceFileEvents recording each file write with FileSize and InitiatingProcessAccountName.
- Test 2Large Single-File Archive Copy to USB Drive
Expected signal: Sysmon Event ID 11: FileCreate for E:\archive_test.zip with FileSize ~60MB. DeviceFileEvents recording a single file write exceeding the 50MB threshold.
References (5)
- https://attack.mitre.org/techniques/T1052/001/
- https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control
- https://learn.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-to-go-faq
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1052.001/T1052.001.md
- https://www.sans.org/white-papers/usb-exfiltration/
Response Playbook
Triage
- Confirm the physical device class from DeviceEvents/Sysmon Event ID 6416 (driver load) or Windows Event ID 2003/2100 — distinguish a true USB mass storage device from a virtual/network drive letter reused for RDP redirected drives or VM shared folders
- Identify the user account and whether they have a documented business justification for removable media use (e.g., approved offline transfer request, air-gapped environment work order)
- Enumerate the files copied to the device — review DeviceFileEvents or Sysmon Event ID 11 FileCreate records for file names, extensions, and folder origin to determine sensitivity (financial records, source code, PII datasets, HR files)
- Check whether the device is registered/allow-listed in your removable media management solution (e.g., Microsoft Defender for Endpoint Device Control, BitLocker To Go enforcement, or a third-party USB control agent)
- Determine if the copied files were encrypted at rest or if BitLocker To Go / equivalent encryption was enforced on the target volume — unencrypted bulk transfers of sensitive data warrant immediate escalation
- Review the user's badge/access logs and physical location at the time of the event to corroborate whether this aligns with an expected offline work scenario or represents an anomaly (e.g., copy occurring after hours or from a terminated employee's account)
Containment
- If unauthorized, physically retrieve or request return of the USB device before the user leaves the premises or logs off the endpoint
- Apply or verify Group Policy / Intune removable storage restrictions (Device Installation Restrictions, BitLocker To Go mandatory encryption) to block further writes from the affected endpoint
- Isolate the endpoint via EDR (Microsoft Defender: Isolate device) if malware or automated exfiltration tooling is suspected rather than manual insider activity
- Disable the user's account and revoke active sessions if insider threat or credential compromise is suspected pending investigation
- Preserve the USB device (do not reformat or reuse) as forensic evidence for HR/Legal if an insider threat investigation is opened
Evidence Collection
- Windows Event ID 2003/2100 (DriverFrameworks-UserMode) and Event ID 6416/6419/6420/6421 (Security log, if PnP activity auditing is enabled) — device arrival and removal timestamps with device description and serial number
- Sysmon Event ID 11 (FileCreate) — full list of files written to the removable volume with timestamps and full paths
- Windows Registry: `HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR` and `HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices` — historical record of every USB storage device ever connected, including serial numbers
- Setupapi log: `C:\Windows\inf\setupapi.dev.log` — device installation history with precise timestamps
- Windows Search / Shellbags artifacts (`NTUSER.DAT\Software\Microsoft\Windows\Shell\BagMRU`) — records of folders browsed on the removable volume
- Microsoft Defender for Endpoint Device Control audit logs (if licensed) — policy evaluation results for the specific device and user
Escalation Criteria
- !Sensitive file types confirmed among the copied files: financial records, source code, credential files, PII/PHI datasets, or M&A/legal documents
- !The user account belongs to a departing or recently notified-of-termination employee, a contractor near contract end, or an account flagged in a prior insider risk review
- !The removable device is not registered in the organization's asset inventory or approved device list
- !The copy activity occurred outside normal business hours, from a remote/VPN session, or immediately followed access to a sensitive file share the user does not typically use
- !Multiple endpoints show the same user or device pattern within a short window, suggesting coordinated or repeated exfiltration attempts
- !The BitLocker To Go / encryption enforcement policy was bypassed or disabled just prior to the event
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows Registry: `HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR` — vendor, product, and serial number of every USB mass storage device ever connected to the host - >
Windows Registry: `HKLM\SYSTEM\MountedDevices` — maps drive letters to device unique identifiers, useful for correlating drive letter reuse across sessions - >
File System: `C:\Windows\inf\setupapi.dev.log` — chronological device driver installation log including first-connect timestamps - >
Windows Event Log: Security Event ID 6416 (new external device recognized), 4663 (object access, if SACL configured on sensitive folders) - >
Windows Prefetch: `explorer.exe` prefetch and jump list entries referencing the removable drive letter and recently accessed files - >
USB device serial number correlation across `USBSTOR` and `Windows Portable Devices\Devices` registry keys to build a complete device usage history for the user
Tuning Guidance
USB exfiltration detection has a high false-positive baseline in organizations without removable media governance. Start by inventorying legitimate removable media use cases: authorized backup procedures, IT imaging workflows, and creative/media team asset transfers. Where possible, deploy device control (Microsoft Defender for Endpoint Device Control, BitLocker To Go enforcement) to restrict writes to only IT-registered and encrypted devices, then scope this detection to fire only on unregistered/unencrypted device writes. Tune the sensitive-path list to match your actual file share taxonomy and DLP classification labels rather than the generic example paths. Exclude known creative/media workstations or asset-heavy departments from the bulk-copy threshold, or raise their threshold substantially. For high-security or air-gapped environments, consider alerting on ANY removable media connection regardless of copy volume, since physical media use itself may be prohibited by policy.
Hunting Queries
Baseline hunt for users or hosts with unusually frequent removable storage device connections over a 30-day period — a high connection count combined with sensitive data access is a strong insider risk indicator.
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType in ("PnpDeviceConnected", "UsbDriveMounted")
| summarize ConnectCount=count(), Devices=make_set(AdditionalFields, 10) by DeviceName, AccountName=InitiatingProcessAccountName
| where ConnectCount > 5
| sort by ConnectCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-DriverFrameworks-UserMode/Operational" EventCode=2003
| stats count as ConnectCount, values(Computer) as Hosts by User
| where ConnectCount > 5
| sort - ConnectCountHunt for hourly windows with unusually large aggregate data volume (>100MB) written to non-system drive letters, independent of USB arrival correlation — catches cases where PnP telemetry is unavailable but file activity still reveals bulk copy behavior.
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath matches regex @"^[D-Z]:\\"
| where FileSize > 10485760
| summarize TotalBytes=sum(FileSize), FileCount=count() by DeviceName, AccountName=InitiatingProcessAccountName, bin(Timestamp, 1h)
| where TotalBytes > 104857600
| sort by TotalBytes descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="D:\\*" OR TargetFilename="E:\\*" OR TargetFilename="F:\\*")
| bin _time span=1h
| stats count as FileCount by Computer, User, _time
| where FileCount > 50
| sort - FileCountAtomic Red Team Tests
Simulates an insider or malicious actor copying a large number of files from a sensitive directory to a removable drive shortly after it is connected. Requires a test USB drive or a mounted volume assigned a non-system drive letter (e.g., E:) and a staged directory of dummy sensitive-looking files.
Command
powershell.exe -Command "New-Item -ItemType Directory -Path 'C:\Finance\TestData' -Force | Out-Null; 1..30 | ForEach-Object { Set-Content -Path \"C:\Finance\TestData\record_$_.csv\" -Value 'account,balance`n1001,54000' }; Copy-Item -Path 'C:\Finance\TestData\*' -Destination 'E:\' -Force"Cleanup
powershell.exe -Command "Remove-Item -Path 'C:\Finance\TestData' -Recurse -Force; Remove-Item -Path 'E:\record_*.csv' -Force -ErrorAction SilentlyContinue"Expected Telemetry
Sysmon Event ID 11: 30 FileCreate events with TargetFilename under E:\ within a few seconds. Windows Event ID 2003/2100 (or DeviceEvents UsbDriveMounted) showing the E: volume was previously connected. DeviceFileEvents recording each file write with FileSize and InitiatingProcessAccountName.
Expected Detection
KQL: BulkCopyToRemovableMedia fires — FileCount=30 within the 5-minute bin, joined to a prior UsbArrival event for the same DeviceName within 30 minutes. SPL: join between DriverFrameworks-UserMode EventCode=2003 and Sysmon EventCode=11 targeting E:\ produces FileCount>20 within the CopyTime window.
Simulates exfiltration of a single large compressed archive (rather than many small files) to a removable drive — a common pattern when an adversary stages and compresses data before physical exfiltration to reduce file count and copy time.
Command
powershell.exe -Command "$data = [byte[]]::new(60MB); (New-Object Random).NextBytes($data); [IO.File]::WriteAllBytes('C:\Users\Public\Confidential\archive_test.zip', $data); Copy-Item -Path 'C:\Users\Public\Confidential\archive_test.zip' -Destination 'E:\archive_test.zip' -Force"Cleanup
powershell.exe -Command "Remove-Item -Path 'C:\Users\Public\Confidential\archive_test.zip' -Force; Remove-Item -Path 'E:\archive_test.zip' -Force -ErrorAction SilentlyContinue"Expected Telemetry
Sysmon Event ID 11: FileCreate for E:\archive_test.zip with FileSize ~60MB. DeviceFileEvents recording a single file write exceeding the 50MB threshold.
Expected Detection
KQL: BulkCopyToRemovableMedia fires on TotalSizeBytes > 52428800 even though FileCount=1, provided the file arrives within 30 minutes of USB arrival. SPL: file-size-based variant of the hunting query surfaces the single large write in the hourly TotalBytes aggregation.
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.