USB control
Removable storage is the other classic exfiltration and infection path. ElevateIQ gates USB, SD and MMC devices with the same rule engine, request queue and audit trail as elevation, plus a built-in auto-allow model so keyboards and hubs never get caught in the net.
Tenant settings
| Setting | Meaning |
|---|---|
| usb_control_enabled | Master switch. Until it is on, agents receive no USB rules at all. |
| usb_mode | learning: observe and log every plug-in, block nothing. enforce: apply rules and the default action. |
| usb_default_action | What happens when no rule matches: allow (default-open) or deny (default-closed). |
| usb_class_preset | Class-level posture that short-circuits non-storage device classes before the rule engine. |
What happens on plug-in
- The agent captures the device identity: vendor and product IDs, serial, class, container ID, plus enriched strings (manufacturer, product, capacity, bus speed, filesystem).
- The built-in auto-allow tiers (below) pass infrastructure devices through immediately.
- The rule engine evaluates USB rules: deny beats allow, narrower target beats broader.
- No match: the tenant default action applies. If that blocks the device, the user can request an exception from the tray, which lands in the Requests → USB queue.
Rule identity fields
| Field | Notes |
|---|---|
| usb_container_id | The canonical anchor when present: one stable ID per physical device, across all its interfaces and re-plugs. Sufficient identity on its own. |
| usb_vendor_id / usb_product_id | VID and PID, normalized to VID_XXXX / PID_XXXX. At least one is required when there is no container ID. |
| usb_serial | Device serial; a narrowing filter (cheap devices often lack one, so it cannot anchor a rule alone). |
| usb_class_guid | Pins a device class. |
| usb_bus_kinds | Which buses the rule covers: any subset of usb, sd, mmc. Native SD slots count. |
PII attestation
Every USB exception request requires the user to attest to the data involved, and the attestation is stored as a compliance artifact:
| Value | Meaning |
|---|---|
| none | No personal data on the device. |
| encrypted_at_rest | Personal data present; the device encrypts itself. |
| wipe_after_use | Personal data present; the user commits to wiping afterward (the camera SD card workflow). |
Auto-approve and compliance gates
| Rule field | Meaning |
|---|---|
| usb_auto_approve | Matching requests skip the admin queue entirely; the per-use attestation remains the compliance record. Built for recurring workflows. |
| usb_expected_pii_classification | Scopes auto-approve to one attestation level (or any, when empty). |
| usb_requires_host_bitlocker | Defense in depth: the rule refuses to apply on a host whose last check-in reported BitLocker off. |
| usb_auto_revoke_hours | One-shot expiry: the allow stops shipping to agents after N hours. |
Built-in auto-allow tiers
Deny-by-default USB control fails immediately if it eats keyboards. ElevateIQ ships a three-tier exemption model:
| Tier | What | When |
|---|---|---|
| Hypervisor | Parallels, VMware and Hyper-V virtual device IDs. | Always exempt: VM infrastructure, not removable media. |
| Bus infrastructure | Hubs, USB-C controllers, composite parents. | Always exempt: blocking these takes down everything behind them. |
| Boot-time human interface | Keyboards, mice, HID, smart cards, audio, network and printer classes. | Exempt only at boot, so a machine can never lock its user out. A keyboard-class device inserted mid-session is still evaluated: that is exactly the rubber-ducky profile. |
On deny-default tenants the agent additionally hardens the mass-storage driver at the registry level, so storage stays blocked even before the service is fully up.
Device names in the console prefer the enriched "Manufacturer, Product" identity read from the device itself over Windows' generic wrapper names, so you see "SanDisk Ultra Fit (USB 3.2, 64 GB)" instead of a hex tuple.