T1052.001SubTechniqueexfiltrationagent-callable

T1052.001Exfiltration over USB

Sub-technique of T1052

Platforms: Linux · macOS · Windows

ATT&CK version: 14.1

What it is

Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

ATT&CK tactics· 1

Exfiltration

References

  1. https://attack.mitre.org/techniques/T1052/001
Sourced from MITRE ATT&CK Enterprise v14.1. Curated and contextualized for EU compliance use cases by Adam Lundqvist, Founder at SQUR.