Exfiltration Over Physical Medium
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
AN0342's Windows shape is process creation + file creation + file access (4663/4670/4656) on a newly-arrived drive, and its only element not already identical to the USB child T1052.001 is the System-channel drive-creation EventID: 1006/10001 here versus 2003 there. MITRE's brief gives no field detail for 1006/10001 beyond the EventID itself, so there is no way to build a selector for the parent that is not either (a) a guess at undocumented field names, forbidden by AUTHORING.md's field-confidence rule, or (b) a duplicate of the USB child's file-write-to-removable-volume logic with a different, unverifiable EventID swapped in. USB is also the dominant real-world instance of this technique, so T1052.001 is the sibling that should carry this observable when it is authored. […]
What the technique is
Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0342
Detects removable drive insertion followed by unusual file access, compression, or staging activity by unauthorized users or unexpected processes.
- AN0343
Detects mounted external devices (via /media or /mnt) followed by large file read or copy operations by shell scripts, unauthorized users, or staging tools (e.g., tar, rsync).
- AN0344
Detects mounting of external volumes followed by high-volume or sensitive file access via Finder, terminal, or third-party apps (e.g., rsync, zip).
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.