ATT&CK technique
View on MITRE ATT&CK →
T1052
Exfiltration Over Physical Medium
Exfiltration
5 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | New USB Storage Device Mounted | production | 2026-09-18 |
| elastic | Spike in Bytes Sent to an External Device | production | 2026-09-18 |
| elastic | Unusual Process Writing Data to an External Device | production | 2026-09-18 |
| elastic | First Time Seen Removable Device | production | 2026-09-18 |
| sentinel | Mass Download & copy to USB device by single user | Scheduled | — |