ATT&CK Reference
Portfolio

TA0010 · EXFILTRATION

Exfiltration Over Physical Medium

T1052Linux · macOS · Windowsattack.mitre.org

USB drives and other removable media used where the network is monitored.

Detect it with

Removable device insertion events (Event ID 6416) followed by bulk file copies.

Why it matters on shift

Exfiltration Over Physical Medium is one of the concrete ways adversaries achieve exfiltration. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.

What to look for next

After exfiltration, the next tactic is usually Impact. Search your telemetry for the transition before closing the ticket.

1 sub-techniques

How it shows up in practice

  1. T1052.001

    Exfiltration over USB

    Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user.

Kill-chain context

← beforeCommand and ControlExfiltrationafter →Impact