MITRE ATT&CKsub-technique

T1052.001 Exfiltration over USB

Published 2020-03-11 Modified 2026-09-02 Official page ↗
Domain
enterprise
Tactics
Exfiltration
Platforms
Linux, Windows, macOS
Version
1.3
Created
2020-03-11

Description

Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1052 Exfiltration Over Physical Medium technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (3)

  • M1057 Data Loss Prevention mitigation
  • M1034 Limit Hardware Installation mitigation
  • M1042 Disable or Remove Feature or Program mitigation

Referenced by MITRE ATT&CK · uses (7)

  • G0129 Mustang Panda group
  • S0409 Machete software (malware)
  • G0081 Tropic Trooper group
  • S0035 SPACESHIP software (malware)
  • S0092 Agent.btz software (malware)
  • S0125 Remsec software (malware)
  • S0136 USBStealer software (malware)

Referenced by Compliance · mitigates (21)

  • CIS-3.13 Deploy a Data Loss Prevention Solution CIS Safeguard v8.1
  • CIS-3.9 Encrypt Data on Removable Media CIS Safeguard v8.1
  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-23 Data Mining Protection NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-MP-7 Media Use NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-41 Port and I/O Device Access NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SR-4 Provenance NIST 800-53 control

References