Removable storage and device control policies are enforced via Intune
Overview
Section titled “Overview”Microsoft Defender for Endpoint device control restricts the use of removable storage including USB mass storage, MTP devices, optical media, Bluetooth peripherals, and printers by enforcing read, write, and execute access policies at the device class level. When device control is not enforced, an adversary with physical access or a malicious insider can deliver payloads via USB, exfiltrate sensitive data to removable media, or stage execution from auto-running content without any policy intervening. The risk is not limited to targeted attacks: commodity malware has long used removable media as a propagation mechanism, and without enforcement the organization has no preventive control at the boundary between the managed endpoint and the physical world.
Remediation
Section titled “Remediation”- Microsoft Defender for Endpoint device control overview
- Deploy and manage device control with Intune
- Device control policies
- Device control reports
Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | SecOps |
| Category | Endpoint threat protection |
| Product | Intune |
| Feature | Endpoint security |
| Area | Devices and endpoints |
| ATT&CK | T1052.001 Exfiltration over USB, T1091 Replication Through Removable Media, T1200 Hardware Additions |
| Licence | INTUNE_A&WINDEFATP |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.