T1052
Exfiltration Over Physical Medium
Linux · macOS · Windows3 pieces on this siteT1052 on attack.mitre.org
Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Insider threat response plan: evidence, proportion and the employee who may have done nothing
The response where the usual instincts are wrong. Speed matters less than lawfulness, the suspect is a colleague with rights, and half of these turn out to be misunderstanding. A plan for investigating quietly, preserving what you would need, and being able to stand behind how you did it.
Suspected data theft by an insider
A resignation with unusual file access, a DLP alert, or an unexplained large transfer.
Data leaving with a person
A resignation with an unusual access pattern behind it, a bulk download, or a report from a manager.
how MITRE says to see it
Detection of Data Exfiltration via Removable Media
- Detects removable drive insertion followed by unusual file access, compression, or staging activity by unauthorized users or unexpected processes.
- Detects mounted external devices (via /media or /mnt) followed by large file read or copy operations by shell scripts, unauthorized users, or staging tools (e.g., tar, rsync).
- Detects mounting of external volumes followed by high-volume or sensitive file access via Finder, terminal, or third-party apps (e.g., rsync, zip).
what reduces it
- M1034 Limit Hardware Installation. Limit the use of USB devices and removable media within a network.
- M1057 Data Loss Prevention. Data loss prevention can detect and block sensitive data being copied to physical mediums.
- M1042 Disable or Remove Feature or Program. Disable Autorun if it is unnecessary. Disallow or restrict removable media at an organizational policy level if they are not required for business operations.