T1052 · Exfiltration Over Physical Medium

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1052 · Exfiltration Over Physical Medium · Sunturai

attack-patternenterprise-attackT1052

Exfiltration Over Physical Medium

attack-pattern--e6415f09-df0e-48de-9aba-928c902b7549

Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

Created: May 31, 2017, 9:30 PM UTC
Modified: Oct 24, 2025, 5:49 PM UTC

1 sub-technique under this technique

Each is its own technique in the catalogue, with its own detections.

T1052.001Exfiltration over USB

7 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
First Time Seen Removable Device	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Process Writing Data to an External Device	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Spike in Bytes Sent to an External Device	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
New USB Storage Device Mounted	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Mass Download & copy to USB device by single user	Medium	Microsoft Sentinel analytics	Sep 2, 2026	MIT License
Dataverse - Dataverse export copied to USB devices	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Dataverse - Terminated employee exfiltration to USB drive	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License

Showing 7 of 7

Filter in the catalogue

External references

mitre-attackT1052Open reference

Platforms

LinuxmacOSWindows

Kill chain phases

exfiltration

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object