tfMITRE ATT&CK technique

Exfiltration Over Physical Medium T1052

Tactic: Exfiltration
Platforms: Linux, macOS, Windows
Version: 1.3
Created: 31 May 2017
Last modified: 24 October 2025
Contributor: William Cain

Sub-techniques 10 rules across the family · 0 mapped directly to T1052 · 0 of 1 carry rules

Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1052

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Exfiltration Over Physical Medium detection strategy DET0123

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Data Exfiltration via Removable Media

Enterprise

3 platforms

AN0342 · Windows

Detects removable drive insertion followed by unusual file access, compression, or staging activity by unauthorized users or unexpected processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Drive CreationDC0042	WinEventLog:System	EventCode=1006, 10001
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DriveTypeFilter	Filter on removable (e.g., USB) drives only.
ProcessNameExclusionList	Exclude known, approved backup or sync utilities.
TimeWindow	Limit correlation of file access and device mount to a defined window (e.g., <5 minutes).

AN0343 · Linux

Detects mounted external devices (via /media or /mnt) followed by large file read or copy operations by shell scripts, unauthorized users, or staging tools (e.g., tar, rsync).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Drive CreationDC0042	auditd:SYSCALL	device event logs
File AccessDC0055	auditd:SYSCALL	open

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MountPointPattern	Monitor mount points like /media, /mnt, or /run/media.
UserGroupScope	Restrict detection to non-root or unexpected users.
AccessVolumeThreshold	Alert on large file access or copy events.

AN0344 · macOS

Detects mounting of external volumes followed by high-volume or sensitive file access via Finder, terminal, or third-party apps (e.g., rsync, zip).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Drive CreationDC0042	macos:unifiedlog	Volume Mount + File Read
File AccessDC0055	macos:osquery	file_events
Command ExecutionDC0064	fs:fsusage	file system activity monitor

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
VolumeNamePattern	Detect suspicious or unrecognized drive labels (e.g., UNTITLED, BACKUP_VOL).
ProcessOrigin	Detect CLI-based copy operations vs. expected GUI usage.
UserSessionCheck	Alert if process and session context are mismatched (e.g., script from screensaver context).

Exfiltration Over Physical Medium detections T1052

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs