Enforcing USB Storage Policy with PowerShell

Published: 2015-12-09
Last Updated: 2015-12-09 08:27:56 UTC
by Xavier Mertens (Version: 1)
3 comment(s)

In a previous diary, I presented the CIRCLean (USB sanitizer) developed by the Luxembourg CERT (circl.lu). This tool is very useful to sanitize suspicious USB sticks but it lacks of control and enforcement. Nevertheless, how to prevent the user to insert the original USB stick in a port of his computer? 

Amongst many commercial products, Powershell is a good solution! As it interacts nicely with the operating systems, useful actions can be programmed when a specific event occurs like… the insertion of a USB stick. Specific events can registered like this:

Register-WmiEvent -Query <query> -SourceIdentifier <name> -Action { <script block> }

The "query", in WMI Query Language (WQL) format, specifies the WMI event class on which events must be attached. The "name" must be a unique identifier. In "script block", we define the actions to take. In our case, we must monitor the Win32_LogicalDisk instances and define two actions: when a new instance is created (USB stick inserted) and deleted (USB stick removed).

Then, we can use the magic of Powershell to perform plenty of useful actions… In my example, I’m just testing the presence of a specific log file (created by CIRCLean) and if it is not older than 2 days. If the file is not present or older, we just unmount the file system to present the user to access it and display a pop up message. I admin, the current check is not bullet proof but we could elaborate more robust scenarios:

  • Call directly the PyCIRCLean framework and skip the need of a Raspberry Pi (but Python must be available on the workstation)
  • Use the other CIRCLean log file called /log/content.log which contains hashes
  • Generate a hash of files and test them against VT
  • Just generate an alert (Syslog, mail, SNMP, WMI, ...)
  • ... (just adapt it to your environment)

The script can be deployed via a login script on the workstation that must be protected. To unregister the new event, just do this (ex: at logout)

Unregister-Event RemovableDiskDetection

The script is available on my github repository. Here is a small video which demonstrates how it works( https://www.youtube.com/watch?v=3wXk_524qPs): I insert a USB stick which contains the processing.log file, it is mounted. Then I delete the file, eject and reinsert it, access is now denied!

Xavier Mertens
ISC Handler - Freelance Security Consultant

3 comment(s)


This is cool. I've used Group Policy to enforce USB whitelisting, but monitoring of whitelisted devices is difficult because there aren't any events logged in the event viewer (that I know of) for Windows 7 when USB removable device is installed. Someone correct me if I'm wrong, but I was told that MS was going to be introducing some new events in Windows 8, 8.1, or 10 for removable media and USB devices in general. I hadn't thought to use the WMI events as the trigger for monitoring alerts. I don't like the requirement for Python in your use case, but I see the value. We don't add any additional scripting interpreters and use Group Policy to prevent non-admins from accessing the built-in scripting (powershell, cmd/batch, and wscript/cscript/vbs).

I agree on your remark. It was just to give some ideas for actions & remediation :-)
I'd like to detect also toys like the USB Rubber Ducky (HID) but it does not look easy...
I a question: Does your script also prevent attacks from BadUSBs (USB-devices, whose firmware has been modified to attack the system by pretending being a keyboard and e.g. entering some powershell commands) ?

EDIT: Actually you already answered it with the Rubberducky answer^^'

Diary Archives