Exfiltration over USB (T1052.001) is the simplest exfiltration path to describe. Someone, or something running on their behalf, copies data to a USB connected physical device. MITRE files it under the Exfiltration tactic and lists Windows, Linux and macOS as affected platforms.
It matters most where networks are cut off from the internet. MITRE notes that in an air-gapped compromise, exfiltration could occur through a USB device introduced by a user. The drive can be the final exfiltration point, or it can hop data between otherwise disconnected systems.
How attackers use it
MITRE describes two roles for the drive. In the first, it is the exit: data is staged and copied to the device, and the device walks out the door. In the second, it is a bridge: data moves from an isolated machine to a USB drive, and then to a machine that does have connectivity.
The procedure examples on the MITRE page describe malware that copies files to removable drives when they are inserted, or that writes collected data to a hidden folder on the drive. The common thread is that nothing crosses the network, so network monitoring sees nothing.
How to detect it
MITRE's detection strategy for this technique pairs a device event with a data event. The analytics look for:
- USB device insertion followed by high volume or sensitive file access and staging by suspicious processes or accounts.
- On Linux, a USB block device mount followed by file access in sensitive directories or high volume copies by user controlled processes.
- On macOS, an external volume mount followed by a Finder, Terminal or script initiated copy from user profiles, sensitive folders or cloud sync directories to the drive.
A single insertion proves little. The signal is the sequence: a new device, then a burst of reads across folders that process does not normally touch, then writes to the new volume.
How to reduce the risk
MITRE lists three mitigations.
- Disable or remove the feature. Turn off Autorun if it is not needed, and disallow or restrict removable media at an organizational policy level when the business does not require it.
- Limit hardware installation. Restrict the use of USB devices and removable media within the network.
- Use data loss prevention. DLP tooling can detect and block sensitive data being copied to USB devices.
Check your own environment
Read-only checks to see what is already in your fleet:
- Windows PowerShell:
Get-PnpDevice -PresentOnly -Class USBlists connected USB devices. - Windows Command Prompt:
reg query HKLM\SYSTEM\CurrentControlSet\Enum\USBSTORshows storage devices the machine has seen. - Linux shell:
lsblkshows block devices and mount points, andlsusblists USB devices.
Then ask a policy question: which roles actually need removable media, and is everyone else blocked?
Quick check
Why does network monitoring miss this technique?
Because the data never crosses the network. It moves to a physical device, so detection has to come from endpoint and device telemetry.
Which two events does MITRE suggest correlating?
A USB device insertion or mount, followed by high volume or sensitive file access and copy activity.
