Exfiltration over USB
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
AN0616's only 'drive creation' log source in the brief is WinEventLog:System::EventCode=2003, mapped verbatim to sigmaLogsource {product: windows, service: system}. Adversarial review found EventID 2003 for USB/device-connection arrival is documented (USB-forensics literature) as living on Microsoft-Windows-DriverFrameworks-UserMode/Operational, a distinct non-default operational log — not System.evtx, which never carries this record on real Windows telemetry. AUTHORING.md rule 1 forbids inventing a logsource outside the brief's sigmaLogsource objects, and no other Windows logSource in this brief's AN0616 entry (Sysmon EventID 1 process_creation, Sysmon EventID 11 file_event, Security 4663/4670/4656 file_event) represents a drive-mount/device-arrival event at all — they are process and file events, not device events, so none can stand in for the missing channel. […]
What the technique is
Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0616
Detects USB device insertion followed by high-volume or sensitive file access and staging activity by suspicious processes or accounts.
- AN0617
Detects USB block device mount followed by file access in sensitive directories or high-volume copy operations by user-controlled processes.
- AN0618
Detects external volume mount with Finder, Terminal, or script-initiated file copy from user profiles, sensitive folders, or cloud storage sync directories to USB.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.