Exfiltration Over Physical Medium T1052
Tactic: Exfiltration
Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Events covered
9 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 12 | RegistryEvent (Object create and delete) |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| Sysmon | Event ID 14 | RegistryEvent (Key and Value Rename) |
| Defender-CloudAppEvents | any | Cloud app activity |
| Defender-DeviceEvents | UsbDriveMounted | USB drive mounted |
| Defender-DeviceFileEvents | any | File activity |
| Defender-DeviceFileEvents | FileCreated | File created |
| Defender-DeviceFileEvents | FileRenamed | File renamed |
| Defender-DeviceInfo | any | Device information |
Authoring guide
These 6 rules share fields, values, and exclusions.
Fields filtered most (7 distinct)
These fields appear most often in rule filters.
Top indicator values (7 distinct)
These values appear most often in rule predicates.
Rules under this technique
These vendors publish rules tagged with this technique.
Elastic 4 rules
- First Time Seen Removable Device
- New USB Storage Device Mounted
- Spike in Bytes Sent to an External Device
- Unusual Process Writing Data to an External Device