T1052.001 Exfiltration over USB

Technique: T1052.001
Tactics: Exfiltration
Research, 90 days: 1
KEV CVEs mapped: 0
SigmaHQ rules: 0
Elastic, Splunk: 4
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1052/001

MITRE description

Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.(Citation: A USB data exfiltration case study)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-15 GuidePoint GRIT: Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew

Detection coverage

Elastic and Splunk rules

New USB Storage Device Mounted (elastic)
Spike in Bytes Sent to an External Device (elastic)
Unusual Process Writing Data to an External Device (elastic)
First Time Seen Removable Device (elastic)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.