Monitoring USB Drives in Windows Using Wazuh#

1
# Enhanced USB monitoring script for Windows
2
param(
3
    [string]$Action = "monitor"
4
)
5

6
# Function to get detailed USB information
7
function Get-USBDeviceInfo {
8
    $usbDevices = Get-WmiObject Win32_USBControllerDevice | ForEach-Object {
9
        [wmi]($_.Dependent)
10
    } | Where-Object {
11
        $_.Description -like "*Mass Storage*" -or
12
        $_.Description -like "*USB Device*"
13
    }
14

15
    $deviceInfo = @()
16

17
    foreach ($device in $usbDevices) {
18
        $info = @{
19
            DeviceID = $device.DeviceID
20
            Description = $device.Description
21
            Manufacturer = $device.Manufacturer
22
            Status = $device.Status
23
            PNPDeviceID = $device.PNPDeviceID
24
            Caption = $device.Caption
25
            Timestamp = (Get-Date).ToString("yyyy-MM-dd HH:mm:ss")
26
            ComputerName = $env:COMPUTERNAME
27
            Username = $env:USERNAME
28
        }
29

30
        # Get additional storage information if available
31
        if ($device.Description -like "*Mass Storage*") {
32
            $diskDrives = Get-WmiObject Win32_DiskDrive | Where-Object {
33
                $_.PNPDeviceID -eq $device.PNPDeviceID
34
            }
35

36
            foreach ($disk in $diskDrives) {
37
                $info.Size = [math]::Round($disk.Size / 1GB, 2)
38
                $info.Model = $disk.Model
39
                $info.SerialNumber = $disk.SerialNumber
40
            }
41
        }
42

43
        $deviceInfo += $info
44
    }
45

46
    return $deviceInfo
47
}
48

49
# Function to log USB events
50
function Write-USBEventLog {
51
    param(
52
        [hashtable]$DeviceInfo
53
    )
54

55
    $logPath = "C:\ProgramData\Wazuh\usb_events.json"
56
    $json = $DeviceInfo | ConvertTo-Json -Compress
57

58
    # Append to log file
59
    Add-Content -Path $logPath -Value $json
60

61
    # Also write to Windows Event Log
62
    $eventParams = @{
63
        LogName = "Application"
64
        Source = "WazuhUSBMonitor"
65
        EventId = 1001
66
        EntryType = "Information"
67
        Message = "USB Device Connected: $($DeviceInfo.Description) - Serial: $($DeviceInfo.SerialNumber)"
68
    }
69

70
    Write-EventLog @eventParams
71
}
72

73
# Main monitoring logic
74
switch ($Action) {
75
    "monitor" {
76
        $devices = Get-USBDeviceInfo
77
        foreach ($device in $devices) {
78
            Write-USBEventLog -DeviceInfo $device
79
        }
80
    }
81

82
    "block" {
83
        # Block USB storage devices
84
        Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\USBSTOR" -Name "Start" -Value 4
85
        Write-Output "USB storage devices blocked"
86
    }
87

88
    "unblock" {
89
        # Unblock USB storage devices
90
        Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\USBSTOR" -Name "Start" -Value 3
91
        Write-Output "USB storage devices unblocked"
92
    }
93
}

1
# Create scheduled task for USB monitoring
2
$action = New-ScheduledTaskAction -Execute "PowerShell.exe" `
3
    -Argument "-NoProfile -ExecutionPolicy Bypass -File 'C:\Program Files\Wazuh\scripts\usb_monitor.ps1' -Action monitor"
4

5
$trigger = New-ScheduledTaskTrigger -AtStartup -RepetitionInterval (New-TimeSpan -Minutes 5)
6

7
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount
8

9
Register-ScheduledTask -TaskName "WazuhUSBMonitor" `
10
    -Action $action `
11
    -Trigger $trigger `
12
    -Principal $principal `
13
    -Description "Monitor USB device connections for Wazuh"

1
# Generate USB activity report for visualization
2
function Get-USBActivityReport {
3
    param(
4
        [DateTime]$StartDate = (Get-Date).AddDays(-7),
5
        [DateTime]$EndDate = (Get-Date)
6
    )
7

8
    $events = Get-WinEvent -FilterHashtable @{
9
        LogName = 'Security'
10
        ID = 6416
11
        StartTime = $StartDate
12
        EndTime = $EndDate
13
    } -ErrorAction SilentlyContinue
14

15
    $report = @{
16
        TotalConnections = $events.Count
17
        UniqueDevices = @()
18
        TimeDistribution = @{}
19
        UnauthorizedAttempts = 0
20
    }
21

22
    foreach ($event in $events) {
23
        $xml = [xml]$event.ToXml()
24
        $deviceId = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'DeviceId'} | Select-Object -ExpandProperty '#text'
25

26
        # Track unique devices
27
        if ($deviceId -notin $report.UniqueDevices) {
28
            $report.UniqueDevices += $deviceId
29
        }
30

31
        # Time distribution
32
        $hour = $event.TimeCreated.Hour
33
        if ($report.TimeDistribution.ContainsKey($hour)) {
34
            $report.TimeDistribution[$hour]++
35
        } else {
36
            $report.TimeDistribution[$hour] = 1
37
        }
38
    }
39

40
    return $report | ConvertTo-Json
41
}

1
@echo off
2
setlocal EnableDelayedExpansion
3

4
set ACTION=%1
5
set USER=%2
6
set IP=%3
7
set ALERTID=%4
8
set RULEID=%5
9

10
if "%ACTION%"=="add" (
11
    :: Block USB storage
12
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f
13

14
    :: Log the action
15
    echo %date% %time% - USB storage blocked due to rule %RULEID% >> "C:\ProgramData\ossec\logs\active-responses.log"
16

17
    :: Notify user
18
    msg * /TIME:30 "SECURITY ALERT: Unauthorized USB device detected. USB ports have been disabled. Contact IT support."
19
)
20

21
if "%ACTION%"=="delete" (
22
    :: Unblock USB storage
23
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 3 /f
24

25
    :: Log the action
26
    echo %date% %time% - USB storage unblocked >> "C:\ProgramData\ossec\logs\active-responses.log"
27
)

1
# Daily USB Activity Report Script
2
param(
3
    [string]$SmtpServer = "smtp.company.com",
4
    [string]$From = "wazuh@company.com",
5
    [string[]]$To = @("security@company.com"),
6
    [string]$WazuhServer = "https://wazuh.company.com:55000",
7
    [string]$ApiUser = "reporting",
8
    [string]$ApiPass = "SecurePassword123!"
9
)
10

11
# Function to get USB events from Wazuh API
12
function Get-WazuhUSBEvents {
13
    $base64Auth = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("$ApiUser`:$ApiPass"))
14
    $headers = @{
15
        "Authorization" = "Basic $base64Auth"
16
        "Content-Type" = "application/json"
17
    }
18

19
    $body = @{
20
        "query" = @{
21
            "bool" = @{
22
                "must" = @(
23
                    @{ "match" = @{ "rule.groups" = "windows-usb-detect" } }
24
                    @{ "range" = @{ "timestamp" = @{ "gte" = "now-24h" } } }
25
                )
26
            }
27
        }
28
    } | ConvertTo-Json -Depth 10
29

30
    $response = Invoke-RestMethod -Uri "$WazuhServer/security/events" `
31
        -Method Post -Headers $headers -Body $body -SkipCertificateCheck
32

33
    return $response.data.affected_items
34
}
35

36
# Generate report
37
$events = Get-WazuhUSBEvents
38
$date = Get-Date -Format "yyyy-MM-dd"
39

40
$authorizedCount = ($events | Where-Object { $_.rule.id -eq "111001" }).Count
41
$unauthorizedCount = ($events | Where-Object { $_.rule.id -eq "111002" }).Count
42
$uniqueEndpoints = ($events | Select-Object -ExpandProperty agent.name -Unique).Count
43

44
# Create HTML report
45
$html = @"
46
<!DOCTYPE html>
47
<html>
48
<head>
49
    <title>Daily USB Activity Report - $date</title>
50
    <style>
51
        body { font-family: Arial, sans-serif; }
52
        table { border-collapse: collapse; width: 100%; }
53
        th, td { border: 1px solid #ddd; padding: 8px; text-align: left; }
54
        th { background-color: #4CAF50; color: white; }
55
        .unauthorized { background-color: #ffcccc; }
56
        .summary { background-color: #f0f0f0; padding: 10px; margin-bottom: 20px; }
57
    </style>
58
</head>
59
<body>
60
    <h1>Daily USB Activity Report</h1>
61
    <div class="summary">
62
        <h2>Summary for $date</h2>
63
        <ul>
64
            <li>Total USB Connections: $($events.Count)</li>
65
            <li>Authorized Devices: $authorizedCount</li>
66
            <li>Unauthorized Attempts: $unauthorizedCount</li>
67
            <li>Affected Endpoints: $uniqueEndpoints</li>
68
        </ul>
69
    </div>
70

71
    <h2>Unauthorized USB Attempts</h2>
72
    <table>
73
        <tr>
74
            <th>Time</th>
75
            <th>Computer</th>
76
            <th>Device</th>
77
            <th>User</th>
78
        </tr>
79
"@
80

81
foreach ($event in $events | Where-Object { $_.rule.id -eq "111002" }) {
82
    $html += @"
83
        <tr class="unauthorized">
84
            <td>$($event.timestamp)</td>
85
            <td>$($event.agent.name)</td>
86
            <td>$($event.data.win.eventdata.deviceDescription)</td>
87
            <td>$($event.data.win.system.computer)\$($event.data.win.eventdata.subjectUserName)</td>
88
        </tr>
89
"@
90
}
91

92
$html += @"
93
    </table>
94

95
    <h2>All USB Activity</h2>
96
    <table>
97
        <tr>
98
            <th>Time</th>
99
            <th>Computer</th>
100
            <th>Device</th>
101
            <th>Status</th>
102
        </tr>
103
"@
104

105
foreach ($event in $events) {
106
    $status = if ($event.rule.id -eq "111001") { "Authorized" } else { "Unauthorized" }
107
    $html += @"
108
        <tr>
109
            <td>$($event.timestamp)</td>
110
            <td>$($event.agent.name)</td>
111
            <td>$($event.data.win.eventdata.deviceDescription)</td>
112
            <td>$status</td>
113
        </tr>
114
"@
115
}
116

117
$html += @"
118
    </table>
119
</body>
120
</html>
121
"@
122

123
# Send email
124
Send-MailMessage -SmtpServer $SmtpServer -From $From -To $To `
125
    -Subject "Daily USB Activity Report - $date" `
126
    -Body $html -BodyAsHtml

1
# PCI DSS Compliance Check for USB Controls
2
function Test-USBCompliance {
3
    $results = @{
4
        "2.3_Encrypted_Admin_Access" = $false
5
        "7.1_Access_Control" = $false
6
        "9.7_Media_Control" = $false
7
        "10.6_Log_Review" = $false
8
    }
9

10
    # Check if USB blocking is configured
11
    $usbStorStart = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\USBSTOR" -Name Start
12
    if ($usbStorStart.Start -eq 4) {
13
        $results["9.7_Media_Control"] = $true
14
    }
15

16
    # Check if auditing is enabled
17
    $auditPolicy = auditpol /get /subcategory:"Plug and Play Events" | Select-String "Success"
18
    if ($auditPolicy) {
19
        $results["10.6_Log_Review"] = $true
20
    }
21

22
    # Generate compliance report
23
    $results | ConvertTo-Json | Out-File "C:\Compliance\USB_PCI_DSS_Report.json"
24
}

1
# Create ServiceNow incident for unauthorized USB
2
function New-ServiceNowUSBIncident {
3
    param(
4
        [hashtable]$AlertData
5
    )
6

7
    $incident = @{
8
        short_description = "Unauthorized USB Device Detected"
9
        description = @"
10
An unauthorized USB device was connected to a monitored endpoint.
11

12
Computer: $($AlertData.agent.name)
13
Device: $($AlertData.data.win.eventdata.deviceDescription)
14
Device ID: $($AlertData.data.win.eventdata.deviceId)
15
Time: $($AlertData.timestamp)
16
Rule: $($AlertData.rule.description)
17
"@
18
        category = "Security"
19
        subcategory = "Policy Violation"
20
        priority = "2"
21
        impact = "2"
22
    }
23

24
    $json = $incident | ConvertTo-Json
25
    $credential = Get-Credential -UserName "api_user"
26

27
    Invoke-RestMethod -Uri "https://company.service-now.com/api/now/table/incident" `
28
        -Method Post -Body $json -ContentType "application/json" -Credential $credential
29
}

1
# Send Teams notification for USB alerts
2
function Send-TeamsUSBAlert {
3
    param(
4
        [hashtable]$AlertData
5
    )
6

7
    $webhookUrl = "https://outlook.office.com/webhook/YOUR-WEBHOOK-URL"
8

9
    $color = if ($AlertData.rule.id -eq "111002") { "FF0000" } else { "00FF00" }
10
    $title = if ($AlertData.rule.id -eq "111002") { "⚠️ Unauthorized USB Device" } else { "✅ Authorized USB Device" }
11

12
    $message = @{
13
        "@type" = "MessageCard"
14
        "@context" = "https://schema.org/extensions"
15
        "summary" = $title
16
        "themeColor" = $color
17
        "sections" = @(
18
            @{
19
                "activityTitle" = $title
20
                "facts" = @(
21
                    @{ "name" = "Computer"; "value" = $AlertData.agent.name }
22
                    @{ "name" = "Device"; "value" = $AlertData.data.win.eventdata.deviceDescription }
23
                    @{ "name" = "Time"; "value" = $AlertData.timestamp }
24
                    @{ "name" = "User"; "value" = $AlertData.data.win.eventdata.subjectUserName }
25
                )
26
            }
27
        )
28
        "potentialAction" = @(
29
            @{
30
                "@type" = "OpenUri"
31
                "name" = "View in Wazuh"
32
                "targets" = @(
33
                    @{ "os" = "default"; "uri" = "https://wazuh.company.com/app/wazuh" }
34
                )
35
            }
36
        )
37
    }
38

39
    Invoke-RestMethod -Uri $webhookUrl -Method Post -Body ($message | ConvertTo-Json -Depth 10) -ContentType "application/json"
40
}

1
# Configure event log size for security log
2
wevtutil sl Security /ms:2147483648  # 2GB max size
3

4
# Archive old USB events
5
$archivePath = "C:\SecurityArchive\USB_Events_$(Get-Date -Format 'yyyyMMdd').evtx"
6
wevtutil epl Security $archivePath "/q:*[System[EventID=6416]]"

1
# Generate USB forensic timeline
2
function Get-USBForensicTimeline {
3
    param(
4
        [DateTime]$StartDate,
5
        [DateTime]$EndDate,
6
        [string]$ComputerName = $env:COMPUTERNAME
7
    )
8

9
    $events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{
10
        LogName = 'Security'
11
        ID = 6416
12
        StartTime = $StartDate
13
        EndTime = $EndDate
14
    }
15

16
    $timeline = foreach ($event in $events) {
17
        $xml = [xml]$event.ToXml()
18
        $eventData = @{}
19

20
        $xml.Event.EventData.Data | ForEach-Object {
21
            $eventData[$_.Name] = $_.'#text'
22
        }
23

24
        [PSCustomObject]@{
25
            Timestamp = $event.TimeCreated
26
            EventID = $event.Id
27
            Computer = $event.MachineName
28
            DeviceId = $eventData.DeviceId
29
            DeviceDescription = $eventData.DeviceDescription
30
            ClassName = $eventData.ClassName
31
            User = $eventData.SubjectUserName
32
            UserSID = $eventData.SubjectUserSid
33
            Message = $event.Message
34
        }
35
    }
36

37
    $timeline | Export-Csv -Path "USB_Forensic_Timeline_$ComputerName.csv" -NoTypeInformation
38
    return $timeline
39
}

1
# Generate executive dashboard metrics
2
function Get-USBDashboardMetrics {
3
    $metrics = @{
4
        DailyStats = @{
5
            TotalConnections = 0
6
            UnauthorizedAttempts = 0
7
            UniqueEndpoints = 0
8
            ComplianceRate = 0
9
        }
10
        WeeklyTrend = @()
11
        TopViolators = @()
12
        DeviceInventory = @()
13
    }
14

15
    # Gather metrics from Wazuh API
16
    # ... (API calls here)
17

18
    # Calculate compliance rate
19
    $metrics.DailyStats.ComplianceRate =
20
        ($metrics.DailyStats.TotalConnections - $metrics.DailyStats.UnauthorizedAttempts) /
21
        $metrics.DailyStats.TotalConnections * 100
22

23
    # Output for Power BI or other visualization tools
24
    $metrics | ConvertTo-Json -Depth 10 |
25
        Out-File "\\dashboard\usb_metrics_$(Get-Date -Format 'yyyyMMdd').json"
26
}