tfMITRE ATT&CK sub-technique

Exfiltration over USB T1052.001

sub-technique of T1052 Exfiltration Over Physical Medium

Tactic: Exfiltration
Platforms: Linux, Windows, macOS
Version: 1.2
Created: 11 March 2020
Last modified: 24 October 2025
Contributor: William Cain

Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware66th pct

Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Exfiltration over USB MITRE reference T1052.001

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Mustang PandaG0129 ↗

Has used a customized PlugX variant which could exfiltrate documents from air-gapped networks.1

created 2021-04-121 referenceaka TA416

Tropic TrooperG0081 ↗

Has exfiltrated data using USB storage devices.1

created 2019-01-291 referenceaka Pirate Panda

All 2 groups for this technique

Offense vs defense T1052.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Exfiltration over USB detection strategy DET0220

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of USB-Based Data Exfiltration

Enterprise

3 platforms

AN0616 · Windows

Detects USB device insertion followed by high-volume or sensitive file access and staging activity by suspicious processes or accounts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Drive CreationDC0042	WinEventLog:System	EventCode=2003
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SensitiveFilePathRegex	Match data staging or export paths (e.g., .docx, .csv, *.db) to USB volume letters.
UserContext	Limit to users who do not normally use removable devices (e.g., service accounts).
TimeWindow	Correlate events within a short period following USB insert (e.g., 5–10 minutes).

AN0617 · Linux

Detects USB block device mount followed by file access in sensitive directories or high-volume copy operations by user-controlled processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Drive CreationDC0042	auditd:SYSCALL	Kernel Device Events - USB Block Devices
File AccessDC0055	auditd:SYSCALL	open, read

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MountPath	Look for /media/, /mnt/, /run/media/ paths associated with removable storage.
CopyCommandSignature	Detect rsync, cp, tar, zip activity writing to USB mount point.
AccessRateThreshold	Define abnormal access patterns (e.g., >100 files in <5 min).

AN0618 · macOS

Detects external volume mount with Finder, Terminal, or script-initiated file copy from user profiles, sensitive folders, or cloud storage sync directories to USB.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	process_events
Drive CreationDC0042	macos:unifiedlog	Volume Mount + Process Trace + File Read
File AccessDC0055	fs:fsusage	Disk Activity Tracing

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DriveLabelFilter	Flag removable volumes with suspicious or default names (e.g., NO NAME, BACKUP_01).
ScriptExecutionContext	Watch for shell or AppleScript execution tied to USB copy.
VolumeMountFrequency	Detect repeated or abnormal device mounts during work hours.

Exfiltration over USB detections T1052.001

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs