Air-Gap Bridging Exfiltration via Shared USB Media

// Signal 1: the same physical USB storage device (identified by the device serial
// embedded in its PnP DeviceId) connects to two or more distinct hosts within 72 hours
let SameSerialMultiHost = DeviceEvents
| where Timestamp > ago(72h)
| where ActionType == "PnpDeviceConnected"
| where AdditionalFields has "USB"
| extend DeviceIdField = tostring(parse_json(AdditionalFields).DeviceId)
| extend DeviceClass = tostring(parse_json(AdditionalFields).ClassName)
| where DeviceClass in~ ("DiskDrive", "USBSTOR", "USB") or DeviceIdField has "USBSTOR"
| extend USBSerial = tostring(split(DeviceIdField, "\\")[-1])
| where isnotempty(USBSerial) and USBSerial != "0"
| summarize ConnectedHosts = make_set(DeviceName), HostCount = dcount(DeviceName),
    FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
  by USBSerial
| where HostCount >= 2
| mv-expand ConnectedHosts to typeof(string);
// Signal 2: a hidden collector/launcher artifact written to the removable volume root —
// thumb.dd is the documented Agent.btz artifact name; autorun.inf covers older
// auto-execution variants (USBStealer, Machete, USBferry)
let HiddenDropperArtifact = DeviceFileEvents
| where Timestamp > ago(72h)
| where ActionType == "FileCreated"
| where FileName in~ ("thumb.dd", "autorun.inf")
| where FolderPath matches regex @"^[D-Z]:\\$"
| project DeviceName, ArtifactTime = Timestamp, FileName, FolderPath,
    InitiatingProcessFileName, InitiatingProcessCommandLine;
// High-confidence: the shared-serial device also produced a hidden root artifact
// on at least one of the hosts it connected to
let CorrelatedBridging = SameSerialMultiHost
| join kind=inner (HiddenDropperArtifact) on $left.ConnectedHosts == $right.DeviceName
| extend Signal = "SharedUSBWithHiddenArtifact", RiskScore = 90
| project USBSerial, HostCount, ConnectedHosts, FirstSeen, LastSeen, ArtifactTime, FileName, FolderPath,
    InitiatingProcessFileName, InitiatingProcessCommandLine, Signal, RiskScore;
// Lower-confidence standalone signal: the same device on 3+ distinct hosts is
// unusual even without an observed hidden-file drop and warrants review
let MultiHostOnly = SameSerialMultiHost
| where HostCount >= 3
| extend Signal = "SameUSBAcrossThreeOrMoreHosts", RiskScore = 65
| extend ArtifactTime = LastSeen, FileName = "", FolderPath = "",
    InitiatingProcessFileName = "", InitiatingProcessCommandLine = ""
| project USBSerial, HostCount, ConnectedHosts, FirstSeen, LastSeen, ArtifactTime, FileName, FolderPath,
    InitiatingProcessFileName, InitiatingProcessCommandLine, Signal, RiskScore;
union CorrelatedBridging, MultiHostOnly
| sort by RiskScore desc, HostCount desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(
  (EventCode=11 (TargetFilename="D:\\thumb.dd" OR TargetFilename="E:\\thumb.dd" OR TargetFilename="F:\\thumb.dd"
                 OR TargetFilename="D:\\autorun.inf" OR TargetFilename="E:\\autorun.inf" OR TargetFilename="F:\\autorun.inf"))
  OR (EventCode=6416 OR EventCode=2003)
)
| eval SignalType=if(EventCode=11, "HiddenRootArtifact", "USBDeviceConnected")
| eval USBSerial=coalesce(SerialNumber, mvindex(split(DeviceId, "\\"), -1))
| stats values(SignalType) as Signals, dc(host) as UniqueHosts, values(host) as Hosts,
    values(TargetFilename) as Artifacts, earliest(_time) as FirstSeen, latest(_time) as LastSeen
  by USBSerial
| where UniqueHosts >= 2
| eval RiskScore=if(mvfind(Signals, "HiddenRootArtifact") >= 0, 90, 65)
| sort - RiskScore UniqueHosts

file where event.type == "creation" and
  file.name : ("thumb.dd", "autorun.inf") and
  file.path : ("D:\\*", "E:\\*", "F:\\*", "G:\\*") and
  not file.path : ("*\\*\\*")

/* Companion rule (run separately, requires host-correlation post-processing):
   any where event.category == "driver" and event.action == "device-connected" and
   device.type == "USB" */

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') as EventTime,
  hostname as Hostname, "SerialNumber" as USBSerial, "TargetFilename" as Artifact,
  COUNT(DISTINCT hostname) as HostCount
FROM events
WHERE ("TargetFilename" ILIKE '%thumb.dd' OR "TargetFilename" ILIKE '%autorun.inf'
       OR LOGSOURCETYPENAME(logsourceid) = 'Sysmon')
  AND devicetime > (NOW() - 259200000)
GROUP BY hostname, "SerialNumber", "TargetFilename", devicetime
HAVING HostCount >= 2 OR "TargetFilename" IS NOT NULL
ORDER BY HostCount DESC

_sourceCategory=windows/sysmon
| json auto
| where EventID == "11" and (TargetFilename matches "*thumb.dd" or TargetFilename matches "*autorun.inf")
| parse regex field=TargetFilename "^(?P<DriveLetter>[D-Z]):\\\\" nodrop
| where !isNull(DriveLetter)
| stats count as ArtifactCount, values(host) as Hosts, dc(host) as HostCount by TargetFilename
| where HostCount >= 1
| sort by HostCount desc

rule usb_airgap_bridging_hidden_artifact {
  meta:
    author = "Detection Engineering"
    description = "Detects hidden collector artifact drop (thumb.dd/autorun.inf) at removable volume root, indicating air-gap bridging exfiltration (T1052.001)"
    severity = "HIGH"
    tactic = "TA0010"

  events:
    $e.metadata.event_type = "FILE_CREATION"
    re.regex($e.target.file.full_path, `(?i)^[D-Z]:\\(thumb\.dd|autorun\.inf)$`)

  condition:
    $e
}

#event_simpleName="FileWritten"
| TargetFileName=/(?i)^[D-Z]:\\(thumb\.dd|autorun\.inf)$/
| groupBy([ComputerName, TargetFileName], function=[count(aid, as=ArtifactCount), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
| sort(ArtifactCount, order=desc)