What are the signs that removable-media activity is becoming malicious?

When removable-media activity starts to look malicious

Once removable-media use shifts from occasional transfer to a tightly compressed sequence of repository access, device insertion, mass copying, and staging, the behaviour is no longer just “someone using a USB drive.” The practical warning sign is not any single event on its own, but the order, speed, and concentration of actions that suggest preparation for exfiltration rather than normal work.

What the suspicious sequence usually looks like

The clearest pattern is a burst of activity that starts with access to sensitive folders or repositories, followed closely by a new USB attachment, then large file writes to that device, and finally scripting or packaging activity to organise the data. That chain matters because it shows intent: the user is not merely moving one file, but assembling a set of assets for removal. In practice, security teams should treat the combination as more informative than any one step. NIST’s media handling guidance is useful here because it frames removable media as a lifecycle control point, not just a convenience channel, and NIST SP 800-88 Media Sanitization reinforces the importance of controlling how data is moved onto or off portable storage.

Other supporting cues often include repeated archive creation, unusual file extensions, rapid renaming, or transfer activity that does not match the user’s normal job function. If the files being staged are especially sensitive, the concern rises further because removable media can bypass many network-based controls. The signal becomes stronger when the activity happens outside business hours, occurs on a workstation that normally does not handle bulk transfers, or is paired with attempts to disable logging, endpoint protection, or device prompts.

Why speed and order matter more than volume alone

Large file copies are not automatically malicious, and a single USB insertion is a common business event. What makes the behaviour suspicious is the compressed timing between access, attachment, copying, and packaging. A legitimate workflow usually has a broader spread of activity, clearer business context, and less emphasis on rapid sequencing. A malicious workflow often looks deliberate and efficient, because the actor wants to minimise dwell time and complete the transfer before attention is drawn.

That means analysts should pay close attention to adjacency: did the user access sensitive material just before the device appeared, or was the device inserted first and the data access followed? Did the copying begin immediately after repository access, or only after a scripting step that prepared filenames, compressions, or staging directories? Those relationships are often more diagnostic than raw file counts. The issue is not just exfiltration capacity, but whether the behaviour shows a coherent removal workflow.

Signals that make the pattern stronger or weaker

Some factors increase confidence: new or rarely used removable media, encrypted containers created on the fly, copies from multiple sensitive locations into one staging directory, or repeated attempts to access data that is normally outside the user’s role. Signals that weaken confidence include approved backup jobs, known media-handling procedures, change tickets, or a business context that clearly explains the transfer. The most useful judgment is to compare the sequence against the user’s normal pattern and against the sensitivity of the data involved.

If the activity is isolated and slow, it may simply be administrative work. If it is clustered, targeted, and followed by cleanup behaviour, it starts to resemble deliberate staging. That is the point where detection should move from observation to validation: confirm the business justification, inspect the destination volume, and check whether the copied data aligns with the user’s recent access history.

Practitioner Guidance

What to verify: Correlate the removable-media event with file access logs, endpoint telemetry, and user context before deciding whether the activity is malicious. The strongest confirmation is a tight match between recent sensitive access and immediate bulk writes to portable storage.

Common mistake: Treating USB insertion alone as suspicious. In many environments, the more actionable signal is the full chain, sensitive access plus attachment plus staging, especially when it happens quickly and outside the user’s normal pattern.

Decision rule: If the behaviour shows a deliberate staging sequence, elevate it for containment and investigation even if no data loss is yet proven. The objective is to stop a likely removal path before it completes, not to wait for confirmed exfiltration.

Practitioner takeaway: Malicious removable-media activity is usually defined by choreography, not by one event, so the fastest path to good judgment is to focus on sequence, timing, and data sensitivity together.

Related resources from NHI Mgmt Group

• How should teams reduce risk from malicious npm package installs?
• What are the signs that cloud identity monitoring is failing to spot malicious activity?
• What are the signs that malicious crawler activity is already affecting a site?
• What are the signs that a Python package release may contain hidden malicious activity?