T1052.001 — Exfiltration over USB

Tactic: Exfiltration · Platforms: Linux, Windows, macOS

Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between…

Sub-technique of Exfiltration Over Physical Medium (T1052).

Sigma detection rules (3)

T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB

title: "T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB"
id: 76dbe398-4da2-4bec-965a-4c28306ae587
description: 'Detection of USB-Based Data Exfiltration. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: SensitiveFilePathRegex, UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1052/001
author: Shahrukh Khan
date: 2026-02-26
license: MIT
tags:
  - attack.exfiltration
  - attack.t1052.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\rundll32.exe'
    CommandLine|contains|all:
      - 'FileEntry'
      - 'CopyToFolder'

  condition: selection

falsepositives:
  - This exact rundll32 shell32 copy-to-folder pattern (used for USB auto-exfiltration by tools like USBStealer) has very few legitimate uses.

level: high

T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB

title: "T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB"
id: 237ed8d9-8319-4000-b49c-8a4306aebb70
description: 'Detection of USB-Based Data Exfiltration. (The previous version only inspected a1, the first/source argument, which catches copies FROM a USB device inward - the opposite of exfiltration - and misses the real exfil case where the USB mount path is the destination argument. Because flags shift argv positions for cp/rsync, e.g. -r before the paths, the USB mount path is now matched against a1, a2, or a3 rather than a single fixed slot.) Tune using: MountPath, CopyCommandSignature, AccessRateThreshold.'
references:
  - https://attack.mitre.org/techniques/T1052/001
author: Shahrukh Khan
date: 2026-05-24
license: MIT
tags:
  - attack.exfiltration
  - attack.t1052.001

logsource:
  category: process_creation
  product: linux

detection:
  selection_cmd:
    type: EXECVE
    a0|endswith:
      - '/cp'
      - '/rsync'
  selection_usb_path:
    - a1|contains:
        - '/media/'
        - '/mnt/usb'
        - '/run/media/'
    - a2|contains:
        - '/media/'
        - '/mnt/usb'
        - '/run/media/'
    - a3|contains:
        - '/media/'
        - '/mnt/usb'
        - '/run/media/'

  condition: selection_cmd and selection_usb_path

falsepositives:
  - Routine legitimate file copies to/from removable USB storage by end users; this rule cannot reliably determine exfiltration direction from argv alone since cp/rsync argument order shifts with flags, so it flags any cp/rsync invocation referencing a USB mount path in any argument position - tune AccessRateThreshold and MountPath to the organization's known removable-media policy.

level: medium

T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB

title: "T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB"
id: dab9d2be-f632-44be-894a-10caf9dc4b29
description: 'Detection of USB-Based Data Exfiltration. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DriveLabelFilter, ScriptExecutionContext, VolumeMountFrequency.'
references:
  - https://attack.mitre.org/techniques/T1052/001
author: Shahrukh Khan
date: 2026-05-02
license: MIT
tags:
  - attack.exfiltration
  - attack.t1052.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/cp'
      - '/rsync'
      - '/ditto'
  selection_target:
    CommandLine|contains: '/Volumes/'
  condition: selection and selection_target

falsepositives:
  - Legitimate backups or file transfers to USB flash drives or external disks by end users.

level: medium

Explore