<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-usb-device-control
description: >-
  Implement USB device control policies to prevent unauthorized removable
  media usage, data exfiltration via USB, and BadUSB/rubber ducky attacks.
  Covers device whitelisting, GPO enforcement, endpoint agent policies,
  and monitoring of USB device connection events.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - usb
  - removable-media
  - device-control
  - data-exfiltration
  - badusb
  - gpo
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1091", "T1052.001", "T1200"]
  tools: [python3, powershell, reg, udevadm]
---

# Implementing USB Device Control

## Overview

USB devices are a dual threat: data exfiltration via removable storage and
malware delivery via BadUSB or weaponized drives. Device control requires
whitelisting authorized devices by vendor/product ID, blocking unauthorized
storage class devices, monitoring plug events, and implementing read-only
policies where storage is required.

## Prerequisites

| Requirement | Purpose |
|---|---|
| GPO or MDM | Deploy USB policies at scale |
| Device inventory | Authorized USB device vendor/product IDs |
| Sysmon or EDR | Monitor USB connection events |
| Audit policy | Log removable storage access |

## Workflow

### Step 1: Inventory Connected USB Devices

```powershell
# List all connected USB devices
Get-PnpDevice -Class USB | Select-Object Status, Class, FriendlyName, InstanceId

# Get detailed USB storage device info
Get-WmiObject Win32_DiskDrive | Where-Object { $_.InterfaceType -eq "USB" } |
  Select-Object Model, InterfaceType, SerialNumber, Size

# Extract Vendor ID and Product ID
Get-PnpDevice -Class USB | ForEach-Object {
  $id = $_.InstanceId
  if ($id -match 'VID_([0-9A-F]+)&PID_([0-9A-F]+)') {
    [PSCustomObject]@{
      Device = $_.FriendlyName
      VendorId = $Matches[1]
      ProductId = $Matches[2]
    }
  }
}
```

### Step 2: Deploy GPO Device Restrictions

```powershell
# Block all removable storage devices
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" `
  /v Deny_All /t REG_DWORD /d 1 /f

# Block write access to removable storage (read-only mode)
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" `
  /v Deny_Write /t REG_DWORD /d 1 /f

# Prevent installation of new USB storage devices
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" `
  /v DenyDeviceClasses /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses" `
  /v 1 /t REG_SZ /d "{36fc9e60-c465-11cf-8056-444553540000}" /f
```

### Step 3: Linux USB Control with udev

```bash
# Block all USB storage devices
cat <<'EOF' > /etc/udev/rules.d/99-usb-block.rules
# Block USB mass storage
ACTION=="add", SUBSYSTEMS=="usb", ATTRS{bInterfaceClass}=="08", RUN+="/bin/sh -c 'echo 0 > /sys$DEVPATH/authorized'"
EOF

# Allow specific device by vendor/product ID
cat <<'EOF' > /etc/udev/rules.d/98-usb-whitelist.rules
# Allow specific Yubikey
ACTION=="add", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0407", ATTR{authorized}="1"
EOF

udevadm control --reload-rules
```

### Step 4: Monitor USB Connection Events

```powershell
# Windows — Sysmon EID 1 for USB-related processes
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational';Id=1} |
  Where-Object { $_.Message -match 'USB|removable' }

# Security EID 6416 — new external device recognized
Get-WinEvent -FilterHashtable @{LogName='Security';Id=6416} |
  Select-Object TimeCreated, Message

# Security EID 4663 — file access on removable storage
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4663} |
  Where-Object { $_.Message -match 'Removable Storage' }
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| New USB storage device | EID 6416 | Previously unseen USB device connected |
| File copy to USB | EID 4663 | Write operations to removable storage |
| USB device blocked | GPO audit | Blocked device installation attempt |

```yaml
title: USB Mass Storage Device Connected
id: b8c9d0e1-f234-5678-ghij-901234567890
status: experimental
description: Detects connection of USB mass storage devices to endpoints
logsource:
  category: system
  product: windows
detection:
  selection:
    EventID: 6416
    DeviceDescription|contains: "Mass Storage"
  condition: selection
falsepositives:
  - Authorized USB devices in device whitelist
level: medium
tags:
  - attack.t1091
  - attack.initial_access
```

## Verification

- [ ] USB storage devices blocked by default on all managed endpoints
- [ ] Whitelisted devices connect and function correctly
- [ ] Unauthorized device connection attempts generate alerts
- [ ] File write to removable storage logged when read-only mode
- [ ] Linux udev rules block mass storage class
- [ ] BadUSB attack (HID keyboard emulation) detection configured

## References

- [MITRE T1091 — Replication Through Removable Media](https://attack.mitre.org/techniques/T1091/)
- [MITRE T1052.001 — Exfiltration over USB](https://attack.mitre.org/techniques/T1052/001/)
- [Microsoft — Device Installation Restrictions](https://learn.microsoft.com/en-us/windows/client-management/manage-device-installation-with-group-policy)

---
v1.0 | Validated: 2026-03-18
