Detect Data Exfiltration via USB Removable Media in Microsoft Sentinel
Adversaries and malicious insiders may copy sensitive files to a USB removable drive to exfiltrate data outside of network-monitored channels, bypassing DLP and network-based egress controls entirely. This is especially relevant in air-gapped or high-security environments where physical media is the only viable exfiltration path. Detection combines removable-storage device arrival events with high-volume file-copy activity from sensitive directories to the newly mounted volume within a short window.
MITRE ATT&CK
- Tactic
- Exfiltration
KQL Detection Query
let SensitivePaths = dynamic(["C:\\Finance", "C:\\HR", "C:\\Users\\Public\\Confidential", "\\Shares\\Legal", "\\Shares\\Engineering"]);
// Signal 1: Removable storage device plugged in (DeviceEvents PnP/USB events)
let UsbArrival = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("PnpDeviceConnected", "UsbDriveMounted")
| project Timestamp, DeviceName, DeviceId=AdditionalFields, ArrivalTime=Timestamp;
// Signal 2: High volume file copy operations to a removable drive shortly after arrival
let FileCopySignal = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath matches regex @"^[D-Z]:\\" // non-system drive letters commonly assigned to removable media
| where FolderPath has_any (SensitivePaths) or InitiatingProcessFolderPath has_any (SensitivePaths)
| summarize FileCount=count(), TotalSizeBytes=sum(FileSize), Files=make_set(FileName, 20) by DeviceName, AccountName=InitiatingProcessAccountName, bin(Timestamp, 5m)
| where FileCount > 20 or TotalSizeBytes > 52428800
| extend Signal = "BulkCopyToRemovableMedia";
UsbArrival
| join kind=inner (FileCopySignal) on DeviceName
| where FileCopySignal.Timestamp between (ArrivalTime .. ArrivalTime + 30m)
| project Timestamp, DeviceName, AccountName, Signal, FileCount, TotalSizeBytes, Files
| sort by Timestamp descDetects potential exfiltration to USB removable media by correlating (1) removable storage device arrival events from DeviceEvents PnP telemetry with (2) a burst of file copy operations (>20 files or >50MB within 5 minutes) originating from or landing in known sensitive directories, occurring within 30 minutes of the device being connected. The join on device and time window filters out routine, low-volume USB usage.
Data Sources
Required Tables
False Positives & Tuning
- Employees performing legitimate authorized backups to encrypted, IT-issued USB drives as part of an approved data transfer or offline work process
- IT staff imaging or provisioning new workstations using USB media containing bulk file transfers
- Media/creative teams routinely moving large video or design assets to portable drives for client delivery
- Automated backup software configured to target removable or external drives on a schedule
Other platforms for THREAT-Exfil-USBRemovableMedia
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Bulk File Copy to Removable Drive via PowerShell
Expected signal: Sysmon Event ID 11: 30 FileCreate events with TargetFilename under E:\ within a few seconds. Windows Event ID 2003/2100 (or DeviceEvents UsbDriveMounted) showing the E: volume was previously connected. DeviceFileEvents recording each file write with FileSize and InitiatingProcessAccountName.
- Test 2Large Single-File Archive Copy to USB Drive
Expected signal: Sysmon Event ID 11: FileCreate for E:\archive_test.zip with FileSize ~60MB. DeviceFileEvents recording a single file write exceeding the 50MB threshold.
References (5)
- https://attack.mitre.org/techniques/T1052/001/
- https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control
- https://learn.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-to-go-faq
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1052.001/T1052.001.md
- https://www.sans.org/white-papers/usb-exfiltration/
Response Playbook
Triage
- Confirm the physical device class from DeviceEvents/Sysmon Event ID 6416 (driver load) or Windows Event ID 2003/2100 — distinguish a true USB mass storage device from a virtual/network drive letter reused for RDP redirected drives or VM shared folders
- Identify the user account and whether they have a documented business justification for removable media use (e.g., approved offline transfer request, air-gapped environment work order)
- Enumerate the files copied to the device — review DeviceFileEvents or Sysmon Event ID 11 FileCreate records for file names, extensions, and folder origin to determine sensitivity (financial records, source code, PII datasets, HR files)
- Check whether the device is registered/allow-listed in your removable media management solution (e.g., Microsoft Defender for Endpoint Device Control, BitLocker To Go enforcement, or a third-party USB control agent)
- Determine if the copied files were encrypted at rest or if BitLocker To Go / equivalent encryption was enforced on the target volume — unencrypted bulk transfers of sensitive data warrant immediate escalation
- Review the user's badge/access logs and physical location at the time of the event to corroborate whether this aligns with an expected offline work scenario or represents an anomaly (e.g., copy occurring after hours or from a terminated employee's account)
Containment
- If unauthorized, physically retrieve or request return of the USB device before the user leaves the premises or logs off the endpoint
- Apply or verify Group Policy / Intune removable storage restrictions (Device Installation Restrictions, BitLocker To Go mandatory encryption) to block further writes from the affected endpoint
- Isolate the endpoint via EDR (Microsoft Defender: Isolate device) if malware or automated exfiltration tooling is suspected rather than manual insider activity
- Disable the user's account and revoke active sessions if insider threat or credential compromise is suspected pending investigation
- Preserve the USB device (do not reformat or reuse) as forensic evidence for HR/Legal if an insider threat investigation is opened
Evidence Collection
- Windows Event ID 2003/2100 (DriverFrameworks-UserMode) and Event ID 6416/6419/6420/6421 (Security log, if PnP activity auditing is enabled) — device arrival and removal timestamps with device description and serial number
- Sysmon Event ID 11 (FileCreate) — full list of files written to the removable volume with timestamps and full paths
- Windows Registry: `HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR` and `HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices` — historical record of every USB storage device ever connected, including serial numbers
- Setupapi log: `C:\Windows\inf\setupapi.dev.log` — device installation history with precise timestamps
- Windows Search / Shellbags artifacts (`NTUSER.DAT\Software\Microsoft\Windows\Shell\BagMRU`) — records of folders browsed on the removable volume
- Microsoft Defender for Endpoint Device Control audit logs (if licensed) — policy evaluation results for the specific device and user
Escalation Criteria
- !Sensitive file types confirmed among the copied files: financial records, source code, credential files, PII/PHI datasets, or M&A/legal documents
- !The user account belongs to a departing or recently notified-of-termination employee, a contractor near contract end, or an account flagged in a prior insider risk review
- !The removable device is not registered in the organization's asset inventory or approved device list
- !The copy activity occurred outside normal business hours, from a remote/VPN session, or immediately followed access to a sensitive file share the user does not typically use
- !Multiple endpoints show the same user or device pattern within a short window, suggesting coordinated or repeated exfiltration attempts
- !The BitLocker To Go / encryption enforcement policy was bypassed or disabled just prior to the event
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows Registry: `HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR` — vendor, product, and serial number of every USB mass storage device ever connected to the host - >
Windows Registry: `HKLM\SYSTEM\MountedDevices` — maps drive letters to device unique identifiers, useful for correlating drive letter reuse across sessions - >
File System: `C:\Windows\inf\setupapi.dev.log` — chronological device driver installation log including first-connect timestamps - >
Windows Event Log: Security Event ID 6416 (new external device recognized), 4663 (object access, if SACL configured on sensitive folders) - >
Windows Prefetch: `explorer.exe` prefetch and jump list entries referencing the removable drive letter and recently accessed files - >
USB device serial number correlation across `USBSTOR` and `Windows Portable Devices\Devices` registry keys to build a complete device usage history for the user
Tuning Guidance
USB exfiltration detection has a high false-positive baseline in organizations without removable media governance. Start by inventorying legitimate removable media use cases: authorized backup procedures, IT imaging workflows, and creative/media team asset transfers. Where possible, deploy device control (Microsoft Defender for Endpoint Device Control, BitLocker To Go enforcement) to restrict writes to only IT-registered and encrypted devices, then scope this detection to fire only on unregistered/unencrypted device writes. Tune the sensitive-path list to match your actual file share taxonomy and DLP classification labels rather than the generic example paths. Exclude known creative/media workstations or asset-heavy departments from the bulk-copy threshold, or raise their threshold substantially. For high-security or air-gapped environments, consider alerting on ANY removable media connection regardless of copy volume, since physical media use itself may be prohibited by policy.
Hunting Queries
Baseline hunt for users or hosts with unusually frequent removable storage device connections over a 30-day period — a high connection count combined with sensitive data access is a strong insider risk indicator.
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType in ("PnpDeviceConnected", "UsbDriveMounted")
| summarize ConnectCount=count(), Devices=make_set(AdditionalFields, 10) by DeviceName, AccountName=InitiatingProcessAccountName
| where ConnectCount > 5
| sort by ConnectCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-DriverFrameworks-UserMode/Operational" EventCode=2003
| stats count as ConnectCount, values(Computer) as Hosts by User
| where ConnectCount > 5
| sort - ConnectCountHunt for hourly windows with unusually large aggregate data volume (>100MB) written to non-system drive letters, independent of USB arrival correlation — catches cases where PnP telemetry is unavailable but file activity still reveals bulk copy behavior.
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath matches regex @"^[D-Z]:\\"
| where FileSize > 10485760
| summarize TotalBytes=sum(FileSize), FileCount=count() by DeviceName, AccountName=InitiatingProcessAccountName, bin(Timestamp, 1h)
| where TotalBytes > 104857600
| sort by TotalBytes descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="D:\\*" OR TargetFilename="E:\\*" OR TargetFilename="F:\\*")
| bin _time span=1h
| stats count as FileCount by Computer, User, _time
| where FileCount > 50
| sort - FileCountAtomic Red Team Tests
Simulates an insider or malicious actor copying a large number of files from a sensitive directory to a removable drive shortly after it is connected. Requires a test USB drive or a mounted volume assigned a non-system drive letter (e.g., E:) and a staged directory of dummy sensitive-looking files.
Command
powershell.exe -Command "New-Item -ItemType Directory -Path 'C:\Finance\TestData' -Force | Out-Null; 1..30 | ForEach-Object { Set-Content -Path \"C:\Finance\TestData\record_$_.csv\" -Value 'account,balance`n1001,54000' }; Copy-Item -Path 'C:\Finance\TestData\*' -Destination 'E:\' -Force"Cleanup
powershell.exe -Command "Remove-Item -Path 'C:\Finance\TestData' -Recurse -Force; Remove-Item -Path 'E:\record_*.csv' -Force -ErrorAction SilentlyContinue"Expected Telemetry
Sysmon Event ID 11: 30 FileCreate events with TargetFilename under E:\ within a few seconds. Windows Event ID 2003/2100 (or DeviceEvents UsbDriveMounted) showing the E: volume was previously connected. DeviceFileEvents recording each file write with FileSize and InitiatingProcessAccountName.
Expected Detection
KQL: BulkCopyToRemovableMedia fires — FileCount=30 within the 5-minute bin, joined to a prior UsbArrival event for the same DeviceName within 30 minutes. SPL: join between DriverFrameworks-UserMode EventCode=2003 and Sysmon EventCode=11 targeting E:\ produces FileCount>20 within the CopyTime window.
Simulates exfiltration of a single large compressed archive (rather than many small files) to a removable drive — a common pattern when an adversary stages and compresses data before physical exfiltration to reduce file count and copy time.
Command
powershell.exe -Command "$data = [byte[]]::new(60MB); (New-Object Random).NextBytes($data); [IO.File]::WriteAllBytes('C:\Users\Public\Confidential\archive_test.zip', $data); Copy-Item -Path 'C:\Users\Public\Confidential\archive_test.zip' -Destination 'E:\archive_test.zip' -Force"Cleanup
powershell.exe -Command "Remove-Item -Path 'C:\Users\Public\Confidential\archive_test.zip' -Force; Remove-Item -Path 'E:\archive_test.zip' -Force -ErrorAction SilentlyContinue"Expected Telemetry
Sysmon Event ID 11: FileCreate for E:\archive_test.zip with FileSize ~60MB. DeviceFileEvents recording a single file write exceeding the 50MB threshold.
Expected Detection
KQL: BulkCopyToRemovableMedia fires on TotalSizeBytes > 52428800 even though FileCount=1, provided the file arrives within 30 minutes of USB arrival. SPL: file-size-based variant of the hunting query surfaces the single large write in the hourly TotalBytes aggregation.
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.