Exfiltration Over Physical Medium
Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
What is T1052 Exfiltration Over Physical Medium?
Exfiltration Over Physical Medium (T1052) maps to the Exfiltration tactic — the adversary is trying to steal data in MITRE ATT&CK.
This page provides production-ready detection logic for Exfiltration Over Physical Medium, covering the data sources and telemetry it touches: Drive: Drive Creation, File: File Access, File: File Creation, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Exfiltration
- Technique
- T1052 Exfiltration Over Physical Medium
- Canonical reference
- https://attack.mitre.org/techniques/T1052/
let SensitiveExtensions = dynamic(["zip", "rar", "7z", "tar", "gz", "docx", "doc", "xlsx", "xls", "pdf", "pst", "ost", "db", "sql", "bak", "key", "pfx", "p12", "rdp", "kdbx", "csv", "json", "xml", "eml", "mdb", "accdb"]);
// Detect USB/removable media mount events in MDE
let UsbMountEvents = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "UsbDriveMounted"
| extend DriveLetter = toupper(tostring(parse_json(AdditionalFields).DriveLetter))
| extend SerialNumber = tostring(parse_json(AdditionalFields).SerialNumber)
| project MountTime=Timestamp, DeviceName, AccountName, DriveLetter, SerialNumber;
// Detect file writes to removable drive letters following a USB mount
let RemovableFileWrites = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| extend DriveLetter = toupper(substring(FolderPath, 0, 2))
| where DriveLetter matches regex @"^[D-Z]:$"
| extend FileExtension = tolower(tostring(split(FileName, ".")[-1]))
| summarize
FileCount = count(),
SensitiveFileCount = countif(FileExtension in (SensitiveExtensions)),
TotalFileSizeMB = round(sum(FileSize) / 1048576.0, 2),
UniqueExtensions = make_set(FileExtension, 20),
SampleFiles = make_set(FileName, 5),
FirstWrite = min(Timestamp),
LastWrite = max(Timestamp)
by DeviceName, AccountName, DriveLetter;
// Correlate USB mounts with subsequent file write activity on the same drive
UsbMountEvents
| join kind=inner RemovableFileWrites on DeviceName, DriveLetter
| where FirstWrite >= MountTime
| where FileCount > 5 or SensitiveFileCount > 0 or TotalFileSizeMB > 10
| extend ExfiltrationRisk = case(
SensitiveFileCount > 10 or TotalFileSizeMB > 500, "Critical",
SensitiveFileCount > 2 or TotalFileSizeMB > 50, "High",
SensitiveFileCount > 0 or TotalFileSizeMB > 10, "Medium",
FileCount > 50, "Low",
"Low"
)
| project MountTime, DeviceName, AccountName, DriveLetter, SerialNumber,
FileCount, SensitiveFileCount, TotalFileSizeMB, UniqueExtensions,
SampleFiles, FirstWrite, LastWrite, ExfiltrationRisk
| sort by TotalFileSizeMB descDetects exfiltration over physical medium by correlating USB drive mount events (DeviceEvents ActionType=UsbDriveMounted) with subsequent bulk file write operations to the mounted drive letter (DeviceFileEvents). Flags sessions where sensitive file types (archives, Office documents, credentials stores, database files) are written to removable media, or where large volumes of data are transferred. Assigns a risk tier based on sensitive file count and total transfer size. Requires Microsoft Defender for Endpoint P2 with USB device monitoring enabled.
Data Sources
Required Tables
False Positives
- IT administrators performing legitimate data backups to external drives as part of scheduled maintenance procedures
- Employees transferring personal files to USB drives at the end of their workday for personal use (common without DLP policy enforcement)
- Software developers deploying compiled builds or configuration files to USB drives for air-gapped test environments
- Help desk technicians using bootable USB drives (Ventoy, Rufus) that trigger mount events and may include file operations during imaging workflows
- Authorized data migration projects where large volumes of files are moved to external media under change management
Sigma rule & cross-platform mapping
The detection logic for Exfiltration Over Physical Medium (T1052) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for T1052
References (8)
- https://attack.mitre.org/techniques/T1052/
- https://attack.mitre.org/techniques/T1052/001/
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
- https://www.cisa.gov/sites/default/files/publications/fact-sheet-removable-media-508.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1052.001/T1052.001.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file
- https://www.mandiant.com/resources/blog/insider-threats-data-exfiltration
- https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Windows - Copy sensitive documents to USB drive using xcopy
Expected signal: Sysmon Event ID 11: FileCreate events with TargetFilename matching 'E:\staged_exfil\*' written by process 'xcopy.exe'. MDE DeviceFileEvents with ActionType=FileCreated and FolderPath starting with 'E:\staged_exfil'. Sysmon Event ID 1: Process Create for xcopy.exe with CommandLine containing '/S /Y'. Prefetch file created at C:\Windows\Prefetch\XCOPY.EXE-*.pf.
- Test 2Windows - Archive sensitive files and copy to USB using 7-Zip
Expected signal: Sysmon Event ID 11: FileCreate for archive_exfil.zip in %TEMP% (staging) then another FileCreate for archive_exfil.zip on E: (exfil). Sysmon Event ID 1: Process Create for 7z.exe with command line showing source directories. MDE DeviceFileEvents with FileName=archive_exfil.zip and FolderPath=E:\. Prefetch for 7Z.EXE-*.pf created.
- Test 3Windows - Bulk robocopy transfer to USB with logging
Expected signal: Sysmon Event ID 1: Process Create for robocopy.exe with full command line including source, destination, and flags. Sysmon Event ID 11: Multiple FileCreate events on E:\desktop_copy\ for each file transferred, plus FileCreate for robocopy_exfil.log in C:\Windows\Temp. MDE DeviceFileEvents showing bulk writes to E: drive. Prefetch file ROBOCOPY.EXE-*.pf with referenced volume for E:.
- Test 4Linux - Copy credentials and config files to mounted USB
Expected signal: Linux auditd syscall events: openat/read on /etc/passwd, /etc/shadow, ~/.ssh/id_rsa; write syscalls to /media/*/exfil/ paths. Syslog entries showing USB mount event (kernel: usb, scsi: sd). auditd EVENT_TYPE=PATH records for each file accessed. If auditd WATCH rules are configured on /etc/shadow and ~/.ssh/id_rsa, dedicated alerts fire for those accesses.
- Test 5Windows - PowerShell recursive file copy to USB simulating data collection script
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing '-ExecutionPolicy Bypass', 'Get-ChildItem', 'Copy-Item', and target drive 'E:\'. PowerShell ScriptBlock Logging Event ID 4104 with full deobfuscated script content. Sysmon Event ID 11: Multiple FileCreate events on E:\ps_exfil\ for each copied file. MDE DeviceFileEvents with ActionType=FileCreated on DriveLetter=E:.
Response Playbook
Triage
- Identify the physical device serial number from DeviceEvents AdditionalFields or Windows Event ID 20001 in System log — cross-reference against your authorized device inventory to determine if this is an approved, registered USB device
- Determine who connected the device: review AccountName from the UsbDriveMounted event alongside DeviceLogonEvents to confirm which user was logged in at the time of connection — was it the assigned user or a different account?
- Quantify the transfer scope: how many files were written, what was the total size, and what file types were copied? Check for high-value targets: PST/OST email archives, database files (.db, .mdb), credential stores (.kdbx, .pfx), or ZIP archives that could contain bulk collections
- Examine the writing process: which executable wrote files to the drive — was it Windows Explorer (user drag-and-drop), xcopy/robocopy (scripted), 7z/WinRAR (archive compression), or an unknown process? Scripted or archiving-tool use is significantly more suspicious than Explorer
- Check for staging activity in the hours before the USB connection: were large volumes of files collected into a staging directory (e.g., Temp, AppData, a newly created folder) using copy, robocopy, or Find-type commands? Data staging before physical exfiltration is a strong indicator
- Review the user's recent behavior: check sign-in logs, email activity, and DLP alerts for the 48 hours preceding the USB event — look for anomalies such as unusual access to sensitive SharePoint/file shares, large email attachments sent externally, or HR activity suggesting the user may be departing
- Determine if network exfiltration occurred concurrently: pull DeviceNetworkEvents for the same device during the same time window — adversaries sometimes use physical media as a backup channel alongside network exfiltration
Containment
- If active exfiltration is suspected and the user is on-premises: immediately contact security operations to physically intercept the device and secure the USB drive as evidence before the user leaves the building
- Isolate the endpoint via EDR network isolation if remote or if lateral movement is suspected — this prevents further network-based staging or C2 communication while the physical investigation proceeds
- Disable the user's Active Directory account and revoke active SSO/OAuth sessions if data theft by an insider threat or compromised credential is confirmed — coordinate with HR and Legal before account lockout in insider threat scenarios
- Block additional USB storage device connections on the endpoint via Group Policy (HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR, Start=4) or MDM policy until investigation concludes
- Preserve the endpoint's memory and disk state: do NOT reboot or run disk cleanup — create a forensic image if supported by your IR process
- If the device serial number is unknown/unauthorized: add it to your USB device block list in Defender for Endpoint or your DLP solution to prevent use on other corporate endpoints
Evidence Collection
- Windows Registry — HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR: records every USB storage device ever connected to the system, including device description, serial number, and first/last connection timestamps (from registry key last-written dates)
- Windows Registry — HKLM\SYSTEM\CurrentControlSet\Enum\USB: records all USB devices including hubs and non-storage devices with VID/PID for device identification
- Windows Registry — HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices: maps device GUIDs to friendly names for USB devices
- Windows Event Log — System (Event ID 20001): new Plug-and-Play device driver installation events, including device description and device instance ID; timestamps USB connections even without Sysmon
- Windows Event Log — Microsoft-Windows-DriverFrameworks-UserMode/Operational (Event ID 2003): records USB device connections with timestamps
- Windows Event Log — Security (Event ID 4663): object access events on the removable drive if SACL-based auditing is configured on the drive — shows exact files accessed by specific accounts
- Sysmon Event ID 11: file creation events on the removable drive letter, including the writing process image path and hashes
- Shellbags — NTUSER.DAT\Software\Microsoft\Windows\Shell\BagMRU and Bags: records folder navigation to USB drive paths, confirming user manually browsed the device
- LNK files — %APPDATA%\Microsoft\Windows\Recent\: shortcut files may point to documents opened from or saved to the USB drive, with embedded timestamps
- Prefetch — C:\Windows\Prefetch\: XCOPY.EXE-*.pf, ROBOCOPY.EXE-*.pf, 7Z.EXE-*.pf execution timestamps indicate data transfer tool usage
- Volume Shadow Copies: compare VSS snapshots from before and after the USB event to identify which files were accessed or modified during the exfiltration window
Escalation Criteria
- ! USB device serial number is not in the authorized device inventory and data was copied — treat as confirmed exfiltration; escalate to IR team and Legal immediately
- ! User is under active HR investigation, recently resigned, or submitted resignation notice within the past 30 days — insider threat risk is critical; loop in HR and Legal before any confrontation
- ! Sensitive file categories copied include credential stores (KeePass .kdbx, .pfx, .p12 certificates), source code repositories (Git bundles, ZIP archives of src/), or customer PII datasets
- ! Data transfer occurred outside normal business hours (evenings, weekends, holidays) or from an unusual physical location for the user
- ! Volume of data transferred exceeds 1 GB or covers more than 500 files — indicative of bulk collection rather than incidental personal file transfer
- ! Evidence of prior staging activity: files were collected from multiple source directories into a single staging folder before being copied to the USB — this proves premeditation
- ! The writing process was a scripted tool (xcopy, robocopy, rclone, dd, a PowerShell script) rather than Windows Explorer — automated collection is a strong indicator of malicious intent
Investigation Guide
Forensic Artifacts
- >
Registry: HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR — device history including VID, PID, serial number, and connection timestamps derived from key last-written dates; persists even after device removal - >
Registry: HKLM\SYSTEM\CurrentControlSet\Enum\USB — all connected USB devices including hubs; cross-reference with USBSTOR to map storage devices - >
Registry: HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices — GUID-to-friendly-name mapping for drive letters assigned to USB devices - >
Registry: HKLM\SYSTEM\MountedDevices — maps drive letters to device signatures; correlates drive letter (e.g., E:) to USB device at connection time - >
Registry: NTUSER.DAT\Software\Microsoft\Windows\Shell\BagMRU — shellbag entries for folders browsed on USB drives confirm user interaction with the device - >
File System: %APPDATA%\Microsoft\Windows\Recent\*.lnk — LNK shortcut files with embedded target path (USB drive), access timestamp, volume serial number, and MAC address of originating machine - >
File System: C:\Windows\Prefetch\XCOPY.EXE-*.pf, ROBOCOPY.EXE-*.pf, 7Z.EXE-*.pf — execution timestamps and referenced files reveal bulk transfer tool usage - >
Event Log: System Event ID 20001 — timestamps first connection of each USB device; survives log rotation better than file system artifacts - >
Event Log: Microsoft-Windows-DriverFrameworks-UserMode/Operational Event ID 2003 — device plug events with timestamps - >
Event Log: Security Event ID 4663 (Object Access) — per-file access events on the USB drive if SACL auditing is enabled; provides definitive list of files read/written - >
macOS: /private/var/log/system.log and Console.app DiskArbitration events — disk mount/unmount with device identifiers - >
Linux: /var/log/syslog or journalctl entries containing 'usb', 'sd', 'scsi' — device attachment events with device node assignments (e.g., /dev/sdb)
Tuning Guidance
Begin by building an authorized USB device inventory: collect serial numbers of approved drives from your asset management system and load them into a watchlist. Filter alerts where the device serial number matches the approved list. Next, identify legitimate backup windows — if your IT team runs weekly backups to external drives on Friday evenings, exclude those AccountName + time window combinations. For developer teams using bootable USB drives or deploying firmware, create process-based exclusions: allow xcopy/robocopy writes only when the parent process is a known build tool. Tune the file count and size thresholds based on your environment's baseline — start with FileCount > 50 or TotalFileSizeMB > 100 for initial deployment, then tighten after 2-4 weeks of baselining. The most reliable high-fidelity signal is sensitive file type detection (PST, KDBX, PFX, SQL dumps) combined with a non-inventory device — keep this sub-rule at maximum sensitivity. For environments without Sysmon deployed, fall back to Windows Security Event 4663 object access auditing configured on removable drives, though this requires SACL configuration. Consider integrating with your DLP solution's USB block/alert policies to correlate events where a device was flagged but not blocked.
Hunting Queries
Hunt for data staging activity (file creation in Temp directories, creation of archive files) in the hours preceding USB device connections. Pre-staging before physical exfiltration is a key behavioral indicator of malicious intent — opportunistic file theft rarely involves advance preparation, while espionage operations almost always do.
// Hunt for data staging activity in the hours BEFORE a USB device was connected
let LookbackWindow = 4h;
let UsbMountTimes = DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "UsbDriveMounted"
| project DeviceName, AccountName, UsbMountTime=Timestamp;
let StagingActivity = DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileCreated"
| where FolderPath has_any ("\\Temp\\", "\\AppData\\Local\\Temp\\", "\\staged\\", "\\exfil\\", "\\collect\\")
or FileName has_any (".zip", ".rar", ".7z", ".tar", ".gz")
| project DeviceName, AccountName, StagingTime=Timestamp, FileName, FolderPath;
UsbMountTimes
| join kind=inner StagingActivity on DeviceName, AccountName
| where StagingTime between ((UsbMountTime - LookbackWindow) .. UsbMountTime)
| summarize StagingEventCount=count(), StagedFiles=make_set(FileName, 10) by DeviceName, AccountName, UsbMountTime
| where StagingEventCount > 2
| sort by StagingEventCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval TargetLower=lower(TargetFilename)
| eval IsStaging=if(match(TargetLower, "(\\\\temp\\\\|\\\\appdata\\\\local\\\\temp\\\\|\\\\staged\\\\|\\\\exfil\\\\|\\\\collect\\\\.)") OR match(TargetLower, "\.(zip|rar|7z|tar|gz)$"), 1, 0)
| where IsStaging=1
| stats count as StagingCount, values(TargetFilename) as StagedFiles, earliest(_time) as FirstStaging, latest(_time) as LastStaging by host, User
| where StagingCount > 3
| sort - StagingCountHunt for USB device connections and file writes made by privileged accounts or accounts with admin/service naming conventions. Privileged accounts using removable media for data exfiltration can bypass many DLP controls — they have broad file system access and may be trusted by data loss prevention policies.
// Hunt for USB connections by privileged accounts or service accounts
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType == "UsbDriveMounted"
| extend DriveLetter = tostring(parse_json(AdditionalFields).DriveLetter)
| extend SerialNumber = tostring(parse_json(AdditionalFields).SerialNumber)
| join kind=leftouter (
DeviceLogonEvents
| where Timestamp > ago(30d)
| where LogonType in (2, 10, 11)
| project DeviceName, AccountName, IsAdmin=tostring(IsLocalAdmin)
) on DeviceName, AccountName
| summarize
ConnectionCount=count(),
UniqueDevices=dcount(SerialNumber),
DriveLetters=make_set(DriveLetter),
LastSeen=max(Timestamp)
by DeviceName, AccountName, IsAdmin
| where IsAdmin == "1" or AccountName has_any ("svc", "service", "admin", "adm")
| where ConnectionCount > 1
| sort by ConnectionCount descindex=wineventlog sourcetype="WinEventLog:Security" EventCode=4624
| eval IsAdmin=if(match(lower(AccountName), "(admin|adm|svc|service|root)"), 1, 0)
| where IsAdmin=1
| rename AccountName as User, ComputerName as host
| join type=inner host User [
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval DriveLetter=upper(substr(TargetFilename, 1, 2))
| where match(DriveLetter, "^[D-Z]:$")
| rename host as host, User as User
| stats count as WriteCount, values(TargetFilename) as Files by host, User
]
| stats count as LoginCount, sum(WriteCount) as TotalWrites, values(Files) as FilesSampled by host, User
| sort - TotalWritesHunt for users writing files to removable drives across multiple endpoints or in unusually high volumes over the look-back window. A user copying data to USB drives on more than one machine is highly anomalous and may indicate a systematic data theft campaign. High file counts from a single user in a compressed time window also warrant investigation.
// Hunt for high-volume or repeated USB transfers by the same user across multiple endpoints
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileCreated"
| extend DriveLetter = toupper(substring(FolderPath, 0, 2))
| where DriveLetter matches regex @"^[D-Z]:$"
| summarize
TotalFiles=count(),
AffectedDevices=dcount(DeviceName),
DeviceList=make_set(DeviceName, 5),
TotalSizeMB=round(sum(FileSize)/1048576.0, 1),
ActiveDays=dcount(format_datetime(Timestamp, 'yyyy-MM-dd'))
by AccountName
| where AffectedDevices > 1 or TotalSizeMB > 200 or (TotalFiles > 100 and ActiveDays <= 2)
| sort by TotalSizeMB descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval DriveLetter=upper(substr(TargetFilename, 1, 2))
| where match(DriveLetter, "^[D-Z]:$")
| stats
count as TotalFiles,
dc(host) as AffectedHosts,
values(host) as HostList,
dc(strftime("%Y-%m-%d", _time)) as ActiveDays,
earliest(_time) as FirstSeen,
latest(_time) as LastSeen
by User
| where AffectedHosts > 1 OR TotalFiles > 100
| sort - TotalFilesAtomic Red Team Tests
Simulates an insider threat copying sensitive Office documents and PDFs from the user's Documents folder to a USB drive using the native xcopy command. xcopy is a LOLBin commonly used because it is always present on Windows systems and its output is not logged by default. Requires a USB drive mounted as E: (adjust drive letter as needed).
Command
mkdir E:\staged_exfil 2>nul && xcopy /S /Y /I C:\Users\%USERNAME%\Documents\*.docx E:\staged_exfil\ && xcopy /S /Y /I C:\Users\%USERNAME%\Documents\*.pdf E:\staged_exfil\ && xcopy /S /Y /I C:\Users\%USERNAME%\Documents\*.xlsx E:\staged_exfil\Cleanup
rmdir /S /Q E:\staged_exfilExpected Telemetry
Sysmon Event ID 11: FileCreate events with TargetFilename matching 'E:\staged_exfil\*' written by process 'xcopy.exe'. MDE DeviceFileEvents with ActionType=FileCreated and FolderPath starting with 'E:\staged_exfil'. Sysmon Event ID 1: Process Create for xcopy.exe with CommandLine containing '/S /Y'. Prefetch file created at C:\Windows\Prefetch\XCOPY.EXE-*.pf.
Expected Detection
SPL query fires: FileWriteCount > 5 on non-system drive letter, ExfilToolEvents incremented for xcopy.exe. KQL query fires: file writes to E: after USB mount with TotalFileSizeMB and SensitiveFileCount thresholds exceeded. Hunting query 1 fires if Documents folder ZIP activity preceded the USB connection.
Simulates a more sophisticated insider threat who archives and compresses files before copying to USB — reducing transfer time and obscuring file contents. This is a common pattern in corporate espionage cases where the adversary wants to avoid triggering file-by-file DLP inspections. Requires 7-Zip installed at the default path and a USB drive mounted as E:.
Command
"C:\Program Files\7-Zip\7z.exe" a -tzip -mx=5 C:\Users\%USERNAME%\AppData\Local\Temp\archive_exfil.zip C:\Users\%USERNAME%\Documents\*.docx C:\Users\%USERNAME%\Documents\*.xlsx C:\Users\%USERNAME%\Documents\*.pdf && copy C:\Users\%USERNAME%\AppData\Local\Temp\archive_exfil.zip E:\archive_exfil.zipCleanup
del /F C:\Users\%USERNAME%\AppData\Local\Temp\archive_exfil.zip && del /F E:\archive_exfil.zipExpected Telemetry
Sysmon Event ID 11: FileCreate for archive_exfil.zip in %TEMP% (staging) then another FileCreate for archive_exfil.zip on E: (exfil). Sysmon Event ID 1: Process Create for 7z.exe with command line showing source directories. MDE DeviceFileEvents with FileName=archive_exfil.zip and FolderPath=E:\. Prefetch for 7Z.EXE-*.pf created.
Expected Detection
SPL hunting query 1 fires: ZIP file creation in Temp directory (staging) before file write on removable drive. KQL and SPL main queries fire: .zip extension matches SensitiveExtensions, SensitiveFileCount > 0. ExfilToolEvents incremented for 7z.exe in SPL.
Simulates an attacker or malicious insider using robocopy with verbose logging to perform a comprehensive recursive copy of a target directory to a USB drive. Robocopy is a built-in Windows tool that can resume interrupted transfers and copy NTFS metadata, making it suitable for large-scale exfiltration. The /LOG flag creates a local transfer log that can serve as evidence.
Command
robocopy C:\Users\%USERNAME%\Desktop E:\desktop_copy /E /COPYALL /LOG:C:\Windows\Temp\robocopy_exfil.log /NPCleanup
del /F C:\Windows\Temp\robocopy_exfil.log && rmdir /S /Q E:\desktop_copyExpected Telemetry
Sysmon Event ID 1: Process Create for robocopy.exe with full command line including source, destination, and flags. Sysmon Event ID 11: Multiple FileCreate events on E:\desktop_copy\ for each file transferred, plus FileCreate for robocopy_exfil.log in C:\Windows\Temp. MDE DeviceFileEvents showing bulk writes to E: drive. Prefetch file ROBOCOPY.EXE-*.pf with referenced volume for E:.
Expected Detection
SPL query fires: ExfilToolEvents=1 for robocopy.exe, FileWriteCount exceeds threshold. KQL query fires: FileCount and TotalFileSizeMB thresholds triggered on DriveLetter=E:. Hunting query 3 (cross-endpoint) fires if same AccountName was active on multiple machines.
Simulates exfiltration of sensitive system files (SSH keys, password hash file, sudoers, network configuration) to a mounted USB drive on Linux. This pattern is used by attackers with root or sudo access targeting credentials and configuration data that can be used for lateral movement or further access. Requires a USB device mounted at /media/usb or /mnt/usb.
Command
USB_MOUNT=/media/$(whoami)/USB_DRIVE; mkdir -p $USB_MOUNT/exfil && cp /etc/passwd $USB_MOUNT/exfil/ && cp /etc/shadow $USB_MOUNT/exfil/ 2>/dev/null; cp ~/.ssh/id_rsa $USB_MOUNT/exfil/ssh_key 2>/dev/null; cp /etc/sudoers $USB_MOUNT/exfil/ 2>/dev/null; find /etc -name '*.conf' -size -100k 2>/dev/null | head -20 | xargs -I{} cp {} $USB_MOUNT/exfil/ 2>/dev/null; syncCleanup
rm -rf $USB_MOUNT/exfilExpected Telemetry
Linux auditd syscall events: openat/read on /etc/passwd, /etc/shadow, ~/.ssh/id_rsa; write syscalls to /media/*/exfil/ paths. Syslog entries showing USB mount event (kernel: usb, scsi: sd). auditd EVENT_TYPE=PATH records for each file accessed. If auditd WATCH rules are configured on /etc/shadow and ~/.ssh/id_rsa, dedicated alerts fire for those accesses.
Expected Detection
Syslog-based detection (if indexed): USB mount events correlating with cp/find process activity on /etc paths. auditd WATCH-based alerts for /etc/shadow access. Linux file integrity monitoring (AIDE/Tripwire) may flag access to monitored credential files.
Simulates a PowerShell-based data collection and exfiltration script that searches for specific file types across user profile directories and copies them to a USB drive. This pattern appears in automated malware that runs at logon or via scheduled task to collect files when the device is connected. Uses Get-ChildItem and Copy-Item which are less likely to be flagged by basic name-based process allowlists.
Command
powershell.exe -ExecutionPolicy Bypass -Command "$dest = 'E:\ps_exfil'; New-Item -ItemType Directory -Force -Path $dest | Out-Null; Get-ChildItem -Path $env:USERPROFILE -Recurse -Include '*.docx','*.xlsx','*.pdf','*.txt','*.csv' -ErrorAction SilentlyContinue | Where-Object {$_.Length -lt 10MB} | ForEach-Object { Copy-Item $_.FullName -Destination $dest -Force }"Cleanup
Remove-Item -Recurse -Force E:\ps_exfil -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: powershell.exe with CommandLine containing '-ExecutionPolicy Bypass', 'Get-ChildItem', 'Copy-Item', and target drive 'E:\'. PowerShell ScriptBlock Logging Event ID 4104 with full deobfuscated script content. Sysmon Event ID 11: Multiple FileCreate events on E:\ps_exfil\ for each copied file. MDE DeviceFileEvents with ActionType=FileCreated on DriveLetter=E:.
Expected Detection
KQL PowerShell detection (T1059.001) fires on '-ExecutionPolicy Bypass'. KQL physical medium detection fires: file writes on E: with SensitiveFileCount > 0 (docx, xlsx, pdf, csv match SensitiveExtensions). SPL query fires: FileWriteCount exceeds threshold on removable drive with multiple sensitive file types.
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.