Exfiltration Over Physical Medium is ATT&CK T1052. It belongs to the Exfiltration tactic and applies to Linux, macOS and Windows. Not every theft goes over a network.
How attackers use it
MITRE describes the technique as exfiltrating data through a physical medium such as a removable drive. In some situations, such as a compromise of an air-gapped network, exfiltration may happen through a physical medium or device introduced by a user. The medium might be an external hard drive, a USB drive, a cellular phone, an MP3 player or another removable storage or processing device. It can be the final exit point, or a way to hop between systems that are otherwise disconnected.
Air gaps remove the network path, so people become the transport. The physical device is the new channel.
How to detect it
The MITRE analytics describe removable media being attached and then followed by unusual file activity:
- Windows: removable drive insertion followed by unusual file access, compression or staging by unauthorized users or unexpected processes.
- Linux: external devices mounted under /media or /mnt followed by large file reads or copies by shell scripts, unauthorized users or staging tools such as tar and rsync.
- macOS: external volumes mounted, followed by high-volume or sensitive file access through Finder, the terminal, or third-party apps such as rsync and zip.
Data to collect: device connection events, mount events, and file copy activity with the destination volume. Endpoint agents with device control and data loss prevention can log which files were written to which device.
How to reduce the risk
MITRE lists three mitigations:
- Data loss prevention. It can detect and block sensitive data being copied to physical media.
- Limit hardware installation. Limit use of USB devices and removable media within the network.
- Disable or remove features or programs. Turn off Autorun if it is not needed. Disallow or restrict removable media at policy level if the business does not require it.
Where you do need removable media, allow named devices only, and log what is written.
