T1052.001sub-technique of T1052 Exfiltration Over Physical Medium
Exfiltration over USB
Linux · Windows · macOS3 pieces on this siteT1052.001 on attack.mitre.org
Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Insider threat response plan: evidence, proportion and the employee who may have done nothing
The response where the usual instincts are wrong. Speed matters less than lawfulness, the suspect is a colleague with rights, and half of these turn out to be misunderstanding. A plan for investigating quietly, preserving what you would need, and being able to stand behind how you did it.
Suspected data theft by an insider
A resignation with unusual file access, a DLP alert, or an unexplained large transfer.
Data leaving with a person
A resignation with an unusual access pattern behind it, a bulk download, or a report from a manager.
how MITRE says to see it
Detection of USB-Based Data Exfiltration
- Detects USB device insertion followed by high-volume or sensitive file access and staging activity by suspicious processes or accounts.
- Detects USB block device mount followed by file access in sensitive directories or high-volume copy operations by user-controlled processes.
- Detects external volume mount with Finder, Terminal, or script-initiated file copy from user profiles, sensitive folders, or cloud storage sync directories to USB.
what reduces it
- M1034 Limit Hardware Installation. Limit the use of USB devices and removable media within a network.
- M1057 Data Loss Prevention. Data loss prevention can detect and block sensitive data being copied to USB devices.
- M1042 Disable or Remove Feature or Program. Disable Autorun if it is unnecessary. Disallow or restrict removable media at an organizational policy level if they are not required for business operations.