Detect Data from Removable Media by monitoring mount events, file access, and copy operations to and from USB drives, external disks, and other portable media. Flag unusual transfers of sensitive directories, large file movements, or use of unauthorised devices. Enforce device control, log endpoint media activity, and investigate exfiltration through trusted removable storage.
What to look for in removable-media activity
Detection starts with endpoint telemetry that shows when removable storage is attached, accessed, mounted, unmounted, or assigned a drive letter. From there, the key question is whether the activity matches normal user behaviour or a likely staging path for exfiltration, especially when sensitive directories, archives, or unusually large file sets move to a USB device.
High-signal indicators include repeated copy operations to portable media, access to directories that are rarely copied off-host, and transfers that occur outside a user’s typical working pattern. These signals become stronger when the device is not corporate-approved, the same host shows prior suspicious archive activity, or the transfer is followed by network egress that suggests data staging before removal.
Because removable media is often used to bypass perimeter controls, detection should focus on both the file activity and the device context. The Removable Media and USB Control Guide is the most direct internal reference for the policy and telemetry patterns that matter here, while the Data Exfiltration Guide helps place USB transfers in the broader exfiltration detection picture.
How to separate normal copying from suspicious transfer patterns
Good detection is not just “USB inserted, alert fired.” The useful distinction is between ordinary user handling and transfers that imply collection, staging, or removal of sensitive material. That means watching for copy bursts, unusual archive creation, access to source paths that are normally read-only, and copying from servers, jump hosts, or engineering workstations where removable media use is less common.
Security teams should also correlate media activity with endpoint identity, device trust, and user role. A small transfer from an approved encrypted drive used by a known admin may be routine, while the same transfer from an unmanaged endpoint or to a newly seen device is much more suspicious. Large file counts, repeated attempts after device policy warnings, and copying into temporary folders before media write events are especially useful signals.
If you are building detections, anchor them to the behaviours that prove intent: file reads preceding writes, archive or compression creation, and sustained transfer to a removable target. The MITRE ATT&CK Enterprise Matrix is useful for mapping these behaviours to collection and exfiltration techniques, and the Command and Control (C2) Guide helps distinguish media-based transfer from other exfiltration paths that may occur in parallel.
Why device control and endpoint logging matter together
Detection improves when endpoint logging and device control are treated as one control pair. Device control reduces the number of possible transfer paths, but it does not replace telemetry. Logging gives investigators the evidence needed to prove what was mounted, what was copied, which process performed the action, and whether the transfer involved an authorised or blocked device.
From a practitioner perspective, the most useful records are mount/unmount events, process-level file access, device identifiers, file hashes or names where available, and the user context tied to the copy operation. Without those details, teams may know that a USB device was present but still fail to prove whether the event was benign backup activity, accidental transfer, or deliberate exfiltration.
For controls and retention, NIST SP 800-53 Rev 5 Security and Privacy Controls is the most directly relevant external control catalogue for access control, audit logging, and configuration discipline, while NIST SP 800-88 Media Sanitization is relevant when the transfer pattern also raises questions about how data is removed, cleared, or destroyed on portable media.
Risk and Threat Considerations
Removable media is attractive because it can move data out of the environment without using the normal network security path, which makes it a common blind spot in organisations that rely too heavily on egress monitoring alone. It also creates a high-trust transfer path: once a device is accepted by the endpoint, the transfer may look like ordinary local file activity unless media telemetry is collected and analysed.
Failure mechanism: Attackers or insiders exploit allowed or poorly monitored USB access to stage sensitive files locally, compress or bundle them, and move them onto portable storage before the organisation sees any obvious network exfiltration signal.
Impact: Sensitive data can leave the environment with weak traceability, and investigators may find only an endpoint artefact trail if media events, file access, and device identity were logged with enough fidelity to reconstruct the transfer.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1020 — Data Exfiltration | Removable-media transfer is a classic exfiltration path. |
| Recommendation — Map USB copy behaviour to T1020 and alert on collection-to-transfer sequences. | ||
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | Supports endpoint and transfer-path hardening alongside removable-media controls. |
| Recommendation — Restrict portable media use and monitor endpoint transfer activity. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Media detection depends on audit events for mounts, file access, and copies. |
| AC-19 — Access Control for Mobile Devices | Portable media requires explicit control of removable-device access. | |
| Recommendation — Log removable-media events and retain host activity for investigation. Apply removable-media restrictions and approved-device enforcement. | ||
Practitioner Guidance
What to verify: Confirm that your detections distinguish simple media insertion from actual data movement. A useful alert should identify the device, the host, the user, the source path, and the copy process, otherwise it will be difficult to separate legitimate backup use from exfiltration.
Decision rule: If the transfer involves sensitive directories, unmanaged devices, or large bursts of file copying, treat it as a containment and triage event rather than a routine endpoint alert. If the device is approved but the behaviour is unusual, preserve the endpoint evidence before attempting cleanup.
Common mistake: Teams often focus on blocking USB devices while neglecting the investigation data needed when a transfer still occurs through an approved or encrypted drive. Detection quality depends on telemetry depth, not just policy enforcement.
Practitioner takeaway: The best detections prove both that removable media was used and that meaningful data moved to it, because that combination is what turns a routine endpoint event into a credible exfiltration signal.