Exfiltration Over Physical Medium: Exfiltration over USB
- ID
- T1052.001
- Tactics
- TA0010 Exfiltration
- Sub-technique of
- T1052 Exfiltration Over Physical Medium
- Platforms
- Linux, Windows, macOS
- Data sources
- Process Creation, File Creation, File Access, Drive Creation
- Source
- attack.mitre.org
- MITRE last modified
- 3 Sep 2026
Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.[3]
Detection
- DET0220 Detection of USB-Based Data Exfiltration
Data components: Process Creation, File Creation, File Access, Drive Creation
Mitigations (3)
- M1034 Limit Hardware Installation
Limit the use of USB devices and removable media within a network.
- M1042 Disable or Remove Feature or Program
Disable Autorun if it is unnecessary. [1] Disallow or restrict removable media at an organizational policy level if they are not required for business operations. [2]
- M1057 Data Loss Prevention
Data loss prevention can detect and block sensitive data being copied to USB devices.
Groups (2)
Software (5)
References
- Microsoft Disable Autorun
- TechNet Removable Media Control
- A USB data exfiltration case study