Network egress controls cannot see a file that leaves in someone's pocket, and on air-gapped or tightly filtered networks a removable drive is often the only way out. MITRE ATT&CK tracks this as T1052 Exfiltration Over Physical Medium, with one sub-technique, T1052.001 Exfiltration over USB, in the Exfiltration tactic (TA0010) on Windows, Linux and macOS. The ATT&CK v20 description lists external hard drives, USB drives, mobile phones and MP3 players as possible media, used either as the final exfiltration point or to hop between disconnected systems. This guide covers how espionage malware and insiders use it, the Windows, Linux and macOS telemetry that shows a device being mounted and filled, the device control and DLP settings that stop it, and how to test them. It is for detection engineers, endpoint engineers and insider risk teams. For removable media policy as a whole, see the Removable Media and USB Control Guide.
Key takeaways
- Two very different adversaries use it. Espionage malware that ferries data off air-gapped networks, and insiders who copy files before leaving; detection has to serve both.
- Insertion plus volume is the core signal. Every ATT&CK v20 analytic for T1052 starts with a device mount and then looks for unusual file access, staging or copying.
- Turn on the right Windows auditing. Event 6416 (Audit PNP Activity) records the device, and Audit Removable Storage (4656, 4658, 4663) records file access on it; neither is collected unless you enable it.
- Device control beats blocking USB ports. Read-only, allowlisted or encryption-required media keeps business flows working while removing silent write access.
- Malware can stage data for a drive that has not arrived yet. SPACESHIP and USBferry collected data and copied it when removable storage appeared, so watch hidden folders on media as well as user copies.
How the technique works
T1052 needs physical access somewhere in the chain. In malware-driven cases the adversary infects a host, collects data and waits for a removable drive to be connected, then writes the data to it, often hidden. A person, usually unaware, carries the drive to a connected machine where a second component sends the data on. In insider cases the user copies files directly. ATT&CK v20 maps three mitigations: M1034 Limit Hardware Installation, M1042 Disable or Remove Feature or Program (restricting removable media where it is not required) and M1057 Data Loss Prevention.
Related techniques are separate pages in ATT&CK: T1091 Replication Through Removable Media covers getting malware onto disconnected systems, T1092 Communication Through Removable Media covers command traffic carried on drives, T1025 Data from Removable Media covers collecting what is already on a drive, and T1011 Exfiltration Over Other Network Medium covers Bluetooth and cellular paths. See the MITRE ATT&CK T1011 Exfiltration Over Other Network Medium guide for the wireless case.
Cases from ATT&CK v20 and vendor research
| Actor or software | What is recorded | Lesson for defenders |
|---|---|---|
| Tropic Trooper (G0081) with USBferry | Exfiltrated data using USB storage; Trend Micro (May 2020) found the malware checked for network connectivity and, when none was available, copied collected data to USB storage for someone to carry to a connected network | Air-gapped networks were reached through less-secured related organisations, such as a military hospital |
| Mustang Panda (G0129) with PlugX | A customised PlugX variant could exfiltrate documents from air-gapped networks (ATT&CK citing Avira) | Sekoia found the PlugX USB worm hid its files in a RECYCLER.BIN folder on the drive and checked every 30 seconds for new drives |
| SPACESHIP (S0035), APT30 | Copies staged data to removable drives when they are inserted | Staging happens before the drive arrives; look for collection without network egress |
| USBStealer (S0136) | Exfiltrates collected files via removable media from air-gapped victims | Purpose-built tooling exists; isolation alone is not a control |
| Remsec (S0125), ProjectSauron | Module moves data from air-gapped networks to internet-connected systems by USB | Hidden storage areas on media evade casual inspection |
| Agent.btz (S0092) | Creates thumb.dd on every connected USB drive with system information and activity logs | Unexpected files written to media by non-user processes are a strong signal |
| Machete (S0409) | Copies files from every drive to a hidden folder on a removable drive | Hidden-attribute folders created on media by background processes |
Mustang Panda's wider tradecraft, including its removable media worms, is profiled in the Mustang Panda Threat Actor Profile Guide.
What to detect and where
ATT&CK v20 publishes two detection strategies: DET0123 Detection of Data Exfiltration via Removable Media for the parent technique and DET0220 Detection of USB-Based Data Exfiltration for T1052.001. Both pair a mount event with file activity. The table combines their analytics with the Windows audit settings that produce the events.
| Platform | Mount or insertion signal | File activity signal | Notes |
|---|---|---|---|
| Windows | Security 6416 "A new external device was recognized by the system" (Audit PNP Activity), with Device ID, Class Name and Vendor IDs; Defender device control ActionType RemovableStoragePolicyTriggered | Audit Removable Storage: 4656 handle requested, 4663 access attempt, 4658 handle closed, generated for all objects on removable storage with no dependency on SACLs; Sysmon 11 file create; Sysmon 1 for copy, archive and robocopy processes | Microsoft notes 6416 is normally raised by SYSTEM; alert when the subject is another account |
| Linux | Kernel USB block device events and mounts under /media or /mnt (DET0123 AN0343, DET0220 AN0617) | auditd open and read syscalls on sensitive directories; tar, rsync or cp writing to the mount path | Tune by mount path pattern and user group |
| macOS | Unified log volume mount events (AN0344, AN0618) | osquery file_events and fs_usage disk activity; Finder, Terminal or script copies from user profiles or cloud sync folders to the volume | Script-initiated copies matter more than Finder copies |
Correlations worth building
- Mount then bulk write: more than a set number of files or megabytes written to a removable volume within a short window of insertion, by user. ATT&CK exposes time window, drive type and process exclusion list as the tuning elements.
- Background writer: writes to removable media from processes other than Explorer, Finder or approved backup tools, especially rundll32.exe or unsigned binaries in user profile folders, which matches SPACESHIP, Agent.btz and Machete behaviour.
- Hidden folders on media: creation of hidden or system-attribute directories, or directories named like RECYCLER.BIN, on removable volumes.
- Archive before copy: creation of .zip, .rar or .7z files from sensitive paths followed by a removable write (T1560 Archive Collected Data then T1052).
- Insider context: large removable writes by users in their notice period or after an HR trigger; route these to the insider risk process rather than the SOC queue.
Mitigations and controls
| Control | Source | Implementation detail | Trade-off |
|---|---|---|---|
| M1034 Limit Hardware Installation | ATT&CK v20 | Windows device installation restrictions allow or deny drivers by device ID, device instance ID or setup class, delivered by Group Policy or Intune ADMX; blocked devices log PnPDeviceBlocked | Blunt; blocks keyboards or tokens if classes are chosen badly |
| M1042 Disable or Remove Feature or Program | ATT&CK v20 | Disallow removable media at policy level where not required | Needs an exception process for engineering and media teams |
| M1057 Data Loss Prevention | ATT&CK v20 | Endpoint DLP rules that block or require justification for copying labelled content to removable media | Only as good as classification; misses unlabelled data |
| Device control (example: Microsoft Defender for Endpoint) | Vendor documentation | Policies by device, device type, operation (read, write, execute), user group, network location or file type; optional rule that permits only BitLocker-encrypted removable devices (in preview) | Defender device control requires Windows 10 or 11; servers are not supported |
| USB authorisation on Linux (example: USBGuard) | Project documentation | Allowlisting and blocklisting by device attributes using the kernel USB device authorisation feature, with a daemon and rule language | Rule maintenance for each approved device model |
| Physical port controls and kiosk transfer stations | NHI Mgmt Group recommendation | For air-gapped zones, one controlled transfer station that scans and logs every file, with all other ports disabled | Process overhead; works only with strict discipline |
Choosing between options depends on the environment. Office estates usually get most value from read-only by default plus write access for a named group to encrypted, company-issued drives. Air-gapped and OT networks should disable removable storage on every host except transfer stations. Small organisations without device control licences can still apply Group Policy removable storage access settings and Audit Removable Storage. See the Endpoint DLP Guide for content-aware rules and the Data Loss Prevention Policy Template for policy wording.
Where identity fits
Physical exfiltration is tied to a person, which makes identity context the main triage input. Every removable write should resolve to a named user account, not a shared kiosk or generic local account; shared accounts on engineering and lab machines make insider investigations unprovable. Service accounts and other non-human identities have no reason to write to removable media, so any removable write in a service account session is an alert in its own right. On air-gapped networks, transfer stations should require individual authentication and log the account with each file transferred.
How to roll out and test
- Inventory current use: enable Audit PNP Activity and Audit Removable Storage (success) and device control in audit mode for four weeks to learn which users, device models and file volumes are normal.
- Define the policy: agree read-only, encrypted-write and full-block groups with the business and HR; document the exception route.
- Pilot ring: apply write blocking to IT and one business unit first; review RemovableStoragePolicyTriggered events and help desk tickets.
- Roll out in rings: extend by department; keep the previous policy version ready so a ring can be returned to audit mode within one policy refresh if a critical workflow breaks.
- Deploy analytics: enable the mount-then-bulk-write and background-writer rules in alert-only mode, then tune.
- Test: with approval, insert a test drive on a pilot host, copy a set of labelled test files and a test archive, and confirm the audit events, DLP block and SIEM alert all appear with the correct user.
Measuring whether it works
- Coverage: share of endpoints with removable storage auditing and device control enforced, not just deployed.
- Write exposure: number of users with unrestricted write access to removable media, tracked monthly.
- Unencrypted writes: count of writes to non-encrypted removable devices by users in write-enabled groups.
- Test detection: share of quarterly removable exfiltration tests detected, and time to alert.
- Exception hygiene: share of removable media exceptions with an owner and expiry date.
Common failure patterns
- Auditing never turned on: 6416 and the removable storage events depend on audit subcategories that many baselines leave disabled, so investigators find nothing after the fact.
- Blocking storage but not phones: controls written only for mass storage class miss phones and media players attached as portable devices, which ATT&CK lists as T1052 media.
- Air gap treated as the control: USBferry, USBStealer and PlugX exist precisely to cross it; isolated networks need device control and transfer discipline too.
- Broad permanent exceptions: whole engineering groups exempted with no expiry, which become the obvious route for an insider.
- Alerts without user context: device events that cannot be tied to an interactive user session, which stall insider cases.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | TA0010; T1052, T1052.001; DET0123, DET0220; M1034, M1042, M1057 | Technique, detection strategies and mitigations |
| MITRE D3FEND | D3-IOPR IO Port Restriction | Defensive technique NHI Mgmt Group considers relevant |
| NIST SP 800-53 Rev. 5 | MP-7 Media Use; MP-2 Media Access; AC-19 Access Control for Mobile Devices | Restricting and controlling removable media |
| NIST SP 800-53 Rev. 5 | SI-4 System Monitoring; AC-4 Information Flow Enforcement | Monitoring and enforcing flows to media |
| NIST CSF 2.0 | PR.DS-01; DE.CM-03 | Data at rest protection; monitoring personnel activity |
Practitioner checklist
- Enable Audit PNP Activity and Audit Removable Storage on all Windows endpoints and forward 6416, 4656, 4658 and 4663.
- Collect mount and file events on Linux (auditd) and macOS (unified log or osquery) for hosts holding sensitive data.
- Run device control in audit mode, then enforce read-only by default with encrypted-write exceptions.
- Alert on removable writes by background processes and on hidden folders created on media.
- Alert on any removable write in a service account session.
- Disable removable storage on air-gapped hosts except authenticated, logging transfer stations.
- Give every removable media exception an owner and an expiry date.
- Test with labelled files each quarter and record which controls fired.
Standards and references
- MITRE ATT&CK: Exfiltration Over Physical Medium (T1052)
- MITRE ATT&CK: Exfiltration over USB (T1052.001)
- Microsoft Learn: 6416(S) A new external device was recognized by the system
- Microsoft Learn: Audit Removable Storage
- Microsoft Learn: Device control in Microsoft Defender for Endpoint
- USBGuard project documentation
- Trend Micro: Tropic Trooper's Back, USBferry Attack Targets Air-gapped Environments
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: ATT&CK Exfiltration Tactic · Data Exfiltration Guide · Removable Media and USB Control Guide · M1057 Data Loss Prevention · USB Drop Attacks Guide