Detecting Removable-Media Exfiltration over USB

USB exfiltration is mostly an insider and physical-access problem, and it is the route that bypasses every network control on this site. Windows records device connections and, with the right audit policy, the files written to them. The result is a workable detection that depends on enabling the audit settings before an incident.

Signals at a Glance

Mount and Device Events

Endpoint detection platforms record USB mounts directly. Alert on first-seen serials and on any mount on systems where policy says removable media should not appear:

// Microsoft Defender XDR (KQL) - USB mounts with first-seen serial numbers
// tune/validate: AdditionalFields keys vary by agent version; inspect a sample first
let history = DeviceEvents
| where Timestamp between (ago(60d) .. ago(1d))
| where ActionType == "UsbDriveMounted"
| extend serial = tostring(parse_json(AdditionalFields).SerialNumber)
| summarize by DeviceName, serial;
DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "UsbDriveMounted"
| extend serial = tostring(parse_json(AdditionalFields).SerialNumber),
         product = tostring(parse_json(AdditionalFields).ProductName)
| join kind=leftanti history on DeviceName, serial
| project Timestamp, DeviceName, InitiatingProcessAccountName, product, serial

Measuring What Was Copied

Mount events say a drive was present, not what was written. With the Windows Audit Removable Storage policy enabled, Event 4663 records file access on removable volumes. Count writes per user and device and compare them with normal use:

index=wineventlog EventCode=4663 Object_Type=File
    (Accesses="*WriteData*" OR Accesses="*AppendData*")
| rex field=Object_Name "^(?<drive>[A-Za-z]:)"
| lookup removable_drives host drive OUTPUT is_removable
| where is_removable="true"
| bin _time span=1h
| stats count as writes dc(Object_Name) as files values(Process_Name) as procs by _time, host, Account_Name, drive
| where files > 200
| sort - files
``` tune/validate: the removable_drives lookup is built from 6416 and mount events; adjust field names to your TA ```

• Enable Audit Removable Storage through advanced audit policy on endpoints where you want visibility; it is not on by default and generates volume.
• Prefer prevention for sensitive populations: BitLocker To Go enforcement, device control that allows approved serials only, and read-only mounts for most users.
• Add HR context where policy allows: resignation, performance action and contractor offboarding are the highest-risk windows for removable-media copies.
• Remember portable phones and cameras present as MTP, not mass storage, so confirm your policy and telemetry cover those classes too.