Enforcing USB Storage Policy with PowerShell
In a previous diary, I presented the CIRCLean (USB sanitizer) developed by the Luxembourg CERT (circl.lu). This tool is very useful to sanitize suspicious USB sticks but it lacks of control and enforcement. Nevertheless, how to prevent the user to insert the original USB stick in a port of his computer?
Amongst many commercial products, Powershell is a good solution! As it interacts nicely with the operating systems, useful actions can be programmed when a specific event occurs like… the insertion of a USB stick. Specific events can registered like this:
Register-WmiEvent -Query <query> -SourceIdentifier <name> -Action { <script block> }
The "query", in WMI Query Language (WQL) format, specifies the WMI event class on which events must be attached. The "name" must be a unique identifier. In "script block", we define the actions to take. In our case, we must monitor the Win32_LogicalDisk instances and define two actions: when a new instance is created (USB stick inserted) and deleted (USB stick removed).
Then, we can use the magic of Powershell to perform plenty of useful actions… In my example, I’m just testing the presence of a specific log file (created by CIRCLean) and if it is not older than 2 days. If the file is not present or older, we just unmount the file system to present the user to access it and display a pop up message. I admin, the current check is not bullet proof but we could elaborate more robust scenarios:
- Call directly the PyCIRCLean framework and skip the need of a Raspberry Pi (but Python must be available on the workstation)
- Use the other CIRCLean log file called /log/content.log which contains hashes
- Generate a hash of files and test them against VT
- Just generate an alert (Syslog, mail, SNMP, WMI, ...)
- ... (just adapt it to your environment)
The script can be deployed via a login script on the workstation that must be protected. To unregister the new event, just do this (ex: at logout)
Unregister-Event RemovableDiskDetection
The script is available on my github repository. Here is a small video which demonstrates how it works( https://www.youtube.com/watch?v=3wXk_524qPs): I insert a USB stick which contains the processing.log file, it is mounted. Then I delete the file, eject and reinsert it, access is now denied!
Xavier Mertens
ISC Handler - Freelance Security Consultant
PGP Key
Comments
www
Nov 17th 2022
6 months ago
EEW
Nov 17th 2022
6 months ago
qwq
Nov 17th 2022
6 months ago
mashood
Nov 17th 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Dec 3rd 2022
6 months ago
isc.sans.edu
Dec 3rd 2022
6 months ago
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.
<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
isc.sans.edu
Dec 26th 2022
5 months ago
isc.sans.edu
Dec 26th 2022
5 months ago