T1052: Exfiltration Over Physical Medium
Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Analyst context for executives and security teams
Exfiltration over physical medium matters because it bypasses many network-centric assumptions. If sensitive data can be copied to removable storage or moved through devices between disconnected systems, the organization may lose visibility at the exact point where network monitoring, proxy logs, and cloud controls are least useful. This is especially important for environments with air-gapped or segmented systems, regulated data, intellectual property, or operational technology dependencies.
Executive priority
Leaders should treat this as a control-validation issue, not just a malware-detection issue. Key questions are whether removable media use is business-justified, whether exceptions are governed, whether endpoint and DLP evidence can prove policy enforcement, and whether incident responders can reconstruct data movement when the network provides no trail. Priority should go to systems where data sensitivity, segmentation, or operational continuity makes removable media a high-consequence path.
Technical view
For Linux, macOS, and Windows endpoints, SOC and IR teams should validate visibility into removable device connection, mounting, file copy activity, and sensitive data movement. Because ATT&CK provides no official detection text for this technique, detection engineering should be driven by the related detection strategy DET0123, focused on data exfiltration via removable media, and by the sub-technique T1052.001 for USB-specific cases. Analysts should correlate device insertion with unusual file staging, archive creation, large copy operations, access to sensitive repositories, and activity on systems that are expected to be isolated or tightly controlled.
Likely telemetry
- Endpoint device control and hardware installation events
- USB/removable storage connection and mount logs
- File access, copy, rename, archive, and write events to removable media
- DLP alerts or policy events for sensitive data copied to endpoint media
- Endpoint security tool telemetry showing approved or blocked peripheral use
Detection direction
- Confirm whether removable media telemetry is collected consistently across Linux, macOS, and Windows rather than only on managed Windows endpoints.
- Tune detections around business context: approved backup, maintenance, legal discovery, and engineering workflows can create false positives if not modeled.
- Prioritize alerts where removable media activity follows sensitive file access, bulk reads, compression, staging, or activity on segmented or air-gapped systems.
- Use the T1052.001 USB sub-technique as a more specific validation path where USB device use is the primary concern.
- Treat lack of network exfiltration evidence as a blind spot, not proof that data did not leave the environment.
Mitigation priorities
- Start with governance: define where removable media is allowed, who can use it, and what approval or logging is required.
- Apply M1034 Limit Hardware Installation by restricting unauthorized external drives, peripheral devices, and driver installation where business operations allow.
- Use M1057 Data Loss Prevention to identify, categorize, monitor, and control sensitive data movement to removable media.
- Apply M1042 Disable or Remove Feature or Program where unnecessary features or services increase the opportunity for removable media abuse.
- Review exceptions regularly, especially on systems containing regulated data, intellectual property, or operationally critical information.
Analyst notes and limits
This technique is broad and covers physical media as a final exfiltration point or as a bridge between otherwise disconnected systems. The supplied relationships provide one detection strategy, three mitigations, and one USB-focused sub-technique. Local policy, endpoint management maturity, and business use of removable media will determine practical detection fidelity.
The official ATT&CK object does not provide detection guidance, procedure examples, attribution, or active exploitation claims. This take is therefore limited to the supplied technique description, platforms, tactic, external reference, and relationship context. Environment-specific validation is required before assessing actual coverage or risk.
Exfiltration Over Physical Medium
Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1052.001 | Exfiltration over USB Sub-technique | Exfiltration over USB subtechnique of this object. |
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.3 | Current bundle | d2ac0876bd60… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack T1052Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.