How can security teams detect communication through removable media?

What communication through removable media looks like in endpoint telemetry

communication through removable media is usually indirect, but it leaves a consistent trail. The useful pattern is not the USB device alone, it is the sequence of mount events, file access, process activity, and policy exceptions on the same endpoint. When that sequence appears on a system that should not use external storage, it becomes a strong indicator of data movement or execution from outside the normal network path.

Security teams should think in terms of event correlation. A single mount event may be legitimate, but a mount followed by sensitive file reads, archives being created, or executables launched from the device is far more meaningful. That is why removable-media monitoring works best when it is tied to endpoint logging, device control, and alerting on out-of-policy behavior.

For broader investigation context, the same pattern sits within Command and Control (C2) Guide, because removable media can function as an offline delivery or transfer path when network channels are unavailable or closely watched.

Which endpoint behaviors matter most

The highest-value signals are the ones that show data being staged, copied, or executed from the removable device. That includes writes to the device from sensitive source folders, creation of archives or containers just before removal, and binaries or scripts starting from removable paths. On tightly controlled systems, even a permitted mount can be suspicious if the device class, user, or host is outside the expected exception list.

Context also matters. If the endpoint normally blocks USB storage and suddenly accepts a mass-storage device, that is a policy violation worth investigation even before any file activity is confirmed. If the host is a jump box, admin workstation, or other high-trust system, the same behavior carries more operational significance because it can bypass centralized transfer controls and leave less network evidence behind.

For the control side, the dedicated Removable Media and USB Control Guide is the best match for policy design, allowlisting, and device restriction decisions. When the concern is data leaving the endpoint through a physical medium, the broader Data Exfiltration Guide helps place USB transfer in the wider exfiltration workflow.

How to distinguish legitimate use from suspicious transfer

Legitimate use tends to be narrow, documented, and consistent. Suspicious use is usually irregular in timing, host selection, or file volume. A good detection program compares removable-media activity against the endpoint's role, the user's job function, and the approved device population. The same event on a locked-down finance workstation and on a software build laptop should not be judged the same way.

Review exceptions as part of the detection design, not as an afterthought. If the environment relies on temporary access for installers, incident response, or field operations, those exceptions need expiry, ownership, and review. Otherwise, the exception list becomes the easiest place for an attacker or insider to hide.

When teams need a media-handling baseline, NIST SP 800-88 Media Sanitization is useful for deciding how removable storage should be cleared, purged, or destroyed when it leaves service or changes hands.

Risk and Threat Considerations

Removable media is attractive because it can bypass network-based inspection, cloud logging, and egress controls. It also creates a blind spot when organizations assume that blocking internet transfer is enough to prevent data movement or malware introduction. A device that is physically present on the endpoint can still move data out, carry malicious payloads in, or act as a bridge between otherwise isolated environments.

Failure mechanism: The control fails when endpoint telemetry does not correlate device mounts, file activity, and process execution, or when policy exceptions are too broad to distinguish normal use from abuse.

Impact: Sensitive data may be staged and removed without network alerts, unauthorized software may run from external media, and incident responders may lose visibility into the true source or destination of the transfer.

Practitioner Guidance

What to verify: Confirm that mount events are logged with host identity, user context, device class, and timestamp, and that those logs are available in the SIEM with enough fidelity to join against file and process telemetry. If you cannot correlate those three layers, detection will be noisy and easy to evade.

What good looks like: High-risk systems block unauthorized USB classes by default, approved devices are tightly allowlisted, and alerts fire only when removable media use is paired with sensitive file movement or execution from the device. The best programs also track exceptions with an owner and expiry date.

Practitioner takeaway: Treat removable-media detection as a correlation problem, not a single-event problem, because the meaningful signal is the combination of device insertion, file movement, and unexpected execution on the same endpoint.

Related resources from NHI Mgmt Group

• How can security teams detect replication through removable media?
• How can security teams detect Data from Removable Media?
• Why are NHIs a critical concern for security teams?
• What steps should security teams take to prevent Shadow AI risks?