Skip to content
Sign In
Learn

T1052.001

Exfiltration over USB

What it is

An attacker or an insider copies data to a USB storage device and carries it out of the building. It is a sub-technique of Exfiltration Over Physical Medium, under the Exfiltration tactic. It needs no network connection at all, which makes it a common way data leaves a network that has no internet access, and it leaves no network traffic for a monitoring team to see.

How adversaries use it

A USB storage device is connected to a workstation or server, and Windows recognizes it and gives it a drive letter. Files are copied to it, often in a short burst, sometimes after being gathered into one folder or archive first. Then the device is removed and the data leaves with it. Our ranges don't include this technique today, because it needs a physical device in a real machine. This page shows how it would appear in Windows telemetry, so you know what to look for in a network you defend.

Detect it in Elastic

Data source: Windows Security event log

Key fields

event.code: 6416 when a new external device is recognized; 4663 when a file on removable storage is read or written (4656 for a failed attempt) winlog.event_data.DeviceDescription: what Windows calls the device, such as USB Mass Storage Device winlog.event_data.ClassName: the kind of device, such as DiskDrive winlog.event_data.DeviceId: the device's instance path, the same each time that device is connected, if it reports a serial number winlog.event_data.ObjectName: on 4663, the file that was accessed on the drive winlog.event_data.SubjectUserName: on 4663, the account that accessed it host.name, @timestamp

Example event

{
  "host": {
    "name": "ws-120.corp.example"
  },
  "event": {
    "code": "6416",
    "provider": "Microsoft-Windows-Security-Auditing"
  },
  "winlog": {
    "channel": "Security",
    "event_data": {
      "DeviceId": "USBSTOR\\Disk&Ven_Example&Prod_Drive\\0000000001",
      "ClassName": "DiskDrive",
      "DeviceDescription": "USB Mass Storage Device"
    }
  },
  "@timestamp": "2026-03-11T17:42:05.318Z"
}

Hunt guidance

Neither event is recorded by default: 6416 needs Audit PNP Activity and 4663 needs Audit Removable Storage. Check your data view has them before you search. Start with the device: event.code: 6416 and (winlog.event_data.ClassName: "DiskDrive" or winlog.event_data.DeviceDescription: "USB Mass Storage Device"). Then, on the same host and after that time, look for file access on it: event.code: 4663 and host.name: "ws-120.corp.example". Look for a storage device on a host where USB storage is unusual, such as a server; a burst of file access soon after the device appears; sensitive folders or archives among the files; and the same device ID on several hosts.

Ruling out legitimate activity

Approved company drives, IT staff installing software or troubleshooting, and registered backup devices all produce the same events. A device alone is not a finding. Decide on what was copied to it, which account copied it, and whether that matches the person's role and an approved device list.

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

References

Practice it

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.