Exfiltration Over Physical Medium: Exfiltration over USB (T1052.001)

Tactic: Exfiltration · Platforms: Linux, Windows, macOS

The interactive view maps 1 detection strategy, 3 mitigations, 2 threat groups, 5 software entries to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Exfiltration Over Physical Medium (T1052).

Overview

Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

Explore

• Open T1052.001 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1052.001
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan