Threat Hunting Exercise: Analyzing USB Removable Media Mass File Copy Dataset
This hunt covers the classic insider-threat/physical-exfil vector: a simulated Windows Security + Sysmon dataset (usb_removable_media_massfilecopy_2022-07-11T164500.json) capturing T1052.001: Exfiltration Over Physical Medium - Exfiltration over USB, where a user copies a large volume of sensitive files to an external USB drive shortly before an expected departure - a scenario every SOC eventually has to investigate for HR/legal reasons, not just external-attacker reasons.
Step 1: Hypothesis Formation
Hypothesis: A user connects a previously-unseen USB mass storage device, and within a short window copies an abnormally large number of files (or an abnormally large total byte volume) from sensitive network shares/local folders to the device, outside their normal file-access baseline. Indicators:
- Security 6416 (New external device recognized) or Sysmon Event 1 (Explorer/host-process spawn tied to drive letter mount) for a USB mass-storage device not previously seen on this host.
- Sysmon Event 11 (File Create) showing a burst of file creations on the newly-mounted drive letter, mirroring source paths from sensitive shares (e.g., \\FILESERVER01\Finance\, \\FILESERVER01\R&D\).
- Volume/velocity far above the user's historical baseline (e.g., 15 files/week normally vs. 800 files in 20 minutes).
- Device disconnect (Security 6423/Sysmon absence of further activity) shortly after the copy completes - "smash and grab" pattern.
Null Hypothesis: Legitimate backup or authorized data-transfer task (e.g., IT imaging a machine, or an approved offline-work data pull). Invalidate via lack of a change ticket, the specific targeting of sensitive share paths rather than the user's own working directory, and timing correlated with HR-flagged departure/performance events if available.
Rationale: Not every hunt in this series is an external-attacker scenario - physical/insider exfiltration via USB remains one of the most common real-world DLP investigations, and Windows' native USB device and file-creation logging is often sufficient without a dedicated DLP product.
Step 2: Data Sources and Scope
- Sources: Security (6416 device connect, 6423 device disconnect); Sysmon (1 proc create for Explorer drive access, 11 file create/rename); optionally USB device inventory (VID/PID/serial) for asset correlation.
- Scope: ~2022-07-11T16:45:00-17:06:30 UTC; Host: WORKSTATION14.theshire.local; User: tchen (R&D engineer, resignation submitted 3 days prior per HR record); Device: SanDisk Ultra USB 3.0, Serial=4C531001471122117743.
- SIEM Queries (Splunk/ELK):
- New device:
index=security EventID=6416 | where DeviceDescription="USB Mass Storage" | search NOT [inputlookup known_usb_serials.csv] - Copy burst:
index=sysmon EventID=11 TargetFilename="E:\\*" | bucket _time span=5m | stats count by _time | where count > 50 - Source correlation:
index=sysmon EventID=11 TargetFilename="E:\\" | rex field=TargetFilename "E:\\\\(?<fname>.+)" | join fname [search index=sysmon EventID=11 TargetFilename="\\\\\\\\FILESERVER01\\\\R&D\\\\"]
Step 3: Key Findings
Parsed events (9 shown) confirm a first-seen USB device followed by a sustained, high-volume copy operation from R&D source-code and design-document shares, ending with device removal.
| Timestamp (UTC) | Event ID | Channel/Source | Key Details | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-07-11 16:45:02 | 6416 (Device Connect) | Security | DeviceDescription="SanDisk Ultra USB Device"; SerialNumber=4C531001471122117743; ClassName=DiskDrive; SubjectUserName=tchen. | Core IOC: Device serial has zero prior history in the asset inventory for tchen or this host - first-seen external storage. |
| 2022-07-11 16:45:10 | 1 (Proc Create) | Sysmon | Image=explorer.exe; CommandLine references new volume E:\ mount. | User navigates to the newly mounted drive via Explorer. |
| 2022-07-11 16:46:00 | 11 (File Create) x1 | Sysmon | TargetFilename=E:\RD_Backup\readme.txt (48 bytes). | Innocuous-looking first file - could be a decoy or simply the first item copied. |
| 2022-07-11 16:46:05 - 17:04:40 | 11 (File Create) x812 | Sysmon | TargetFilenames under E:\RD_Backup\ mirror source tree \\FILESERVER01\R&D\ProjectPhoenix\ and \\FILESERVER01\R&D\PatentDrafts\*; extensions: .sldprt, .docx, .pdf, .py, .c. | Volume IOC: 812 files copied in ~18 minutes (baseline for tchen: ~15 file accesses/day) - includes CAD design files, patent drafts, and proprietary source code. |
| 2022-07-11 16:50:00 | 11 (File Create) | Sysmon | TargetFilename=\\FILESERVER01\R&D\ProjectPhoenix\ - accessed (read) immediately prior to each corresponding E:\ write, per matching timestamps. | Source IOC: Direct read-then-write pairing confirms the share-to-USB copy path, not a legitimate local-to-USB backup of tchen's own files. |
| 2022-07-11 17:04:45 | 11 (File Create) | Sysmon | TargetFilename=E:\RD_Backup\ProjectPhoenix.zip (1.2GB). | Final action: entire copied tree compressed into a single archive on the USB device - consolidation step typical of deliberate exfil, not casual file-dragging. |
| 2022-07-11 17:05:30 | 1 (Proc Create) | Sysmon | Image=explorer.exe; CommandLine shows deletion of the uncompressed E:\RD_Backup\ subfolder, leaving only the ZIP. | Cleanup step - reduces the chance of casual discovery if the device is later inspected superficially. |
| 2022-07-11 17:06:30 | 6423 (Device Disconnect) | Security | SerialNumber=4C531001471122117743; SubjectUserName=tchen. | Device removed ~21 minutes after connection - "smash and grab" timing consistent with a planned, deliberate action rather than routine backup work spread across a normal workday. |
Validation:
- Timeline: Connect → 812-file copy over 18 minutes → archive consolidation → cleanup → disconnect, all in ~21 minutes, three days after a submitted resignation.
- False Positives: No IT change ticket for device imaging or approved offline work exists for tchen or WORKSTATION14 on this date; the copied content (patent drafts, proprietary CAD files, source code) falls squarely within R&D's defined "crown jewels" data classification, not general working files.
- Correlation: HR resignation-date proximity, source-share sensitivity, copy volume/velocity, and post-copy cleanup behavior together build a strong case for deliberate IP exfiltration ahead of departure.
Step 4: Recommendations & Next Steps
- Response: Engage HR/Legal immediately (this is a personnel matter as much as a technical one); preserve the USB device and WORKSTATION14 for forensic imaging if the device can be recovered before departure; review tchen's remaining access and consider immediate access revocation per offboarding policy; audit whether a signed IP/confidentiality agreement was in place.
- Detection: Sigma:
title: Mass File Copy to Removable Media→selection: EventID=11 TargetFilename matches removable-drive-letter pattern | timeframe: 30m | condition: count by user > 200 files from sensitive share source path. - Pro Tip: Cross-reference USB mass-copy alerts against HR offboarding/resignation events as a standing correlation rule - the "resignation window" is consistently the highest-risk period for this exact behavior pattern across most organizations' insider-threat programs.
Hypothesis confirmed - large-scale proprietary data exfiltration to USB ahead of employee departure! This hunt is a reminder that not every "threat" wears an external attacker's face - Windows-native logging was fully sufficient to build the case here.