Cross-source coverage

T1052 / ATT&CK

Exfiltration Over Physical Medium

5 rules across 2 sources.

From MITRE ATT&CK 19.2

Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

Tactics
Exfiltration
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SysmonWinEventLog:SecurityWinEventLog:Systemauditd:SYSCALLmacos:unifiedlogmacos:osqueryfs:fsusage

How MITRE says to detect it DET0123

Detection of Data Exfiltration via Removable Media

Windows Analytic 0342

Detects removable drive insertion followed by unusual file access, compression, or staging activity by unauthorized users or unexpected processes.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Security EventCode=4663, 4670, 4656
  • WinEventLog:System EventCode=1006, 10001

Linux Analytic 0343

Detects mounted external devices (via /media or /mnt) followed by large file read or copy operations by shell scripts, unauthorized users, or staging tools (e.g., tar, rsync).

  • auditd:SYSCALL open
  • auditd:SYSCALL device event logs

macOS Analytic 0344

Detects mounting of external volumes followed by high-volume or sensitive file access via Finder, terminal, or third-party apps (e.g., rsync, zip).

  • macos:unifiedlog Volume Mount + File Read
  • macos:osquery file_events
  • fs:fsusage file system activity monitor

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 5 above — a rule tagged a sub-technique covers this technique too.

elastic/detection-rules

4 rules
Detection Severity Format
First Time Seen Removable Device Low Elastic TOML
New USB Storage Device Mounted Low Elastic TOML
Spike in Bytes Sent to an External Device Low Elastic TOML
Unusual Process Writing Data to an External Device Low Elastic TOML

Azure/Azure-Sentinel

1 rule
Detection Severity Format
Mass Download & copy to USB device by single user Medium KQL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.