Cross-source coverage
T1052.001 / ATT&CK
Exfiltration Over Physical Medium: Exfiltration over USB
4 rules across 1 source.
From MITRE ATT&CK 19.2
Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
- Tactics
- Exfiltration
- Platforms
- Linux · Windows · macOS
- Telemetry
-
WinEventLog:SysmonWinEventLog:SecurityWinEventLog:Systemauditd:SYSCALLmacos:unifiedlogfs:fsusagemacos:osquery
How MITRE says to detect it DET0220
Detection of USB-Based Data Exfiltration
Windows Analytic 0616
Detects USB device insertion followed by high-volume or sensitive file access and staging activity by suspicious processes or accounts.
WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=11WinEventLog:SecurityEventCode=4663, 4670, 4656WinEventLog:SystemEventCode=2003
Linux Analytic 0617
Detects USB block device mount followed by file access in sensitive directories or high-volume copy operations by user-controlled processes.
auditd:SYSCALLopen, readauditd:SYSCALLKernel Device Events - USB Block Devices
macOS Analytic 0618
Detects external volume mount with Finder, Terminal, or script-initiated file copy from user profiles, sensitive folders, or cloud storage sync directories to USB.
macos:unifiedlogVolume Mount + Process Trace + File Readfs:fsusageDisk Activity Tracingmacos:osqueryprocess_events
elastic/detection-rules
4 rules| Detection | Severity | Format |
|---|---|---|
| First Time Seen Removable Device | Low | Elastic TOML |
| New USB Storage Device Mounted | Low | Elastic TOML |
| Spike in Bytes Sent to an External Device | Low | Elastic TOML |
| Unusual Process Writing Data to an External Device | Low | Elastic TOML |