Detect Exfiltration Over Physical Medium in Microsoft Sentinel
Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
MITRE ATT&CK
- Tactic
- Exfiltration
- Technique
- T1052 Exfiltration Over Physical Medium
- Canonical reference
- https://attack.mitre.org/techniques/T1052/
KQL Detection Query
let SensitiveExtensions = dynamic(["zip", "rar", "7z", "tar", "gz", "docx", "doc", "xlsx", "xls", "pdf", "pst", "ost", "db", "sql", "bak", "key", "pfx", "p12", "rdp", "kdbx", "csv", "json", "xml", "eml", "mdb", "accdb"]);
// Detect USB/removable media mount events in MDE
let UsbMountEvents = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "UsbDriveMounted"
| extend DriveLetter = toupper(tostring(parse_json(AdditionalFields).DriveLetter))
| extend SerialNumber = tostring(parse_json(AdditionalFields).SerialNumber)
| project MountTime=Timestamp, DeviceName, AccountName, DriveLetter, SerialNumber;
// Detect file writes to removable drive letters following a USB mount
let RemovableFileWrites = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| extend DriveLetter = toupper(substring(FolderPath, 0, 2))
| where DriveLetter matches regex @"^[D-Z]:$"
| extend FileExtension = tolower(tostring(split(FileName, ".")[-1]))
| summarize
FileCount = count(),
SensitiveFileCount = countif(FileExtension in (SensitiveExtensions)),
TotalFileSizeMB = round(sum(FileSize) / 1048576.0, 2),
UniqueExtensions = make_set(FileExtension, 20),
SampleFiles = make_set(FileName, 5),
FirstWrite = min(Timestamp),
LastWrite = max(Timestamp)
by DeviceName, AccountName, DriveLetter;
// Correlate USB mounts with subsequent file write activity on the same drive
UsbMountEvents
| join kind=inner RemovableFileWrites on DeviceName, DriveLetter
| where FirstWrite >= MountTime
| where FileCount > 5 or SensitiveFileCount > 0 or TotalFileSizeMB > 10
| extend ExfiltrationRisk = case(
SensitiveFileCount > 10 or TotalFileSizeMB > 500, "Critical",
SensitiveFileCount > 2 or TotalFileSizeMB > 50, "High",
SensitiveFileCount > 0 or TotalFileSizeMB > 10, "Medium",
FileCount > 50, "Low",
"Low"
)
| project MountTime, DeviceName, AccountName, DriveLetter, SerialNumber,
FileCount, SensitiveFileCount, TotalFileSizeMB, UniqueExtensions,
SampleFiles, FirstWrite, LastWrite, ExfiltrationRisk
| sort by TotalFileSizeMB descDetects exfiltration over physical medium by correlating USB drive mount events (DeviceEvents ActionType=UsbDriveMounted) with subsequent bulk file write operations to the mounted drive letter (DeviceFileEvents). Flags sessions where sensitive file types (archives, Office documents, credentials stores, database files) are written to removable media, or where large volumes of data are transferred. Assigns a risk tier based on sensitive file count and total transfer size. Requires Microsoft Defender for Endpoint P2 with USB device monitoring enabled.
Data Sources
Required Tables
False Positives & Tuning
- IT administrators performing legitimate data backups to external drives as part of scheduled maintenance procedures
- Employees transferring personal files to USB drives at the end of their workday for personal use (common without DLP policy enforcement)
- Software developers deploying compiled builds or configuration files to USB drives for air-gapped test environments
- Help desk technicians using bootable USB drives (Ventoy, Rufus) that trigger mount events and may include file operations during imaging workflows
- Authorized data migration projects where large volumes of files are moved to external media under change management
Other platforms for T1052
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Windows - Copy sensitive documents to USB drive using xcopy
Expected signal: Sysmon Event ID 11: FileCreate events with TargetFilename matching 'E:\staged_exfil\*' written by process 'xcopy.exe'. MDE DeviceFileEvents with ActionType=FileCreated and FolderPath starting with 'E:\staged_exfil'. Sysmon Event ID 1: Process Create for xcopy.exe with CommandLine containing '/S /Y'. Prefetch file created at C:\Windows\Prefetch\XCOPY.EXE-*.pf.
- Test 2Windows - Archive sensitive files and copy to USB using 7-Zip
Expected signal: Sysmon Event ID 11: FileCreate for archive_exfil.zip in %TEMP% (staging) then another FileCreate for archive_exfil.zip on E: (exfil). Sysmon Event ID 1: Process Create for 7z.exe with command line showing source directories. MDE DeviceFileEvents with FileName=archive_exfil.zip and FolderPath=E:\. Prefetch for 7Z.EXE-*.pf created.
- Test 3Windows - Bulk robocopy transfer to USB with logging
Expected signal: Sysmon Event ID 1: Process Create for robocopy.exe with full command line including source, destination, and flags. Sysmon Event ID 11: Multiple FileCreate events on E:\desktop_copy\ for each file transferred, plus FileCreate for robocopy_exfil.log in C:\Windows\Temp. MDE DeviceFileEvents showing bulk writes to E: drive. Prefetch file ROBOCOPY.EXE-*.pf with referenced volume for E:.
- Test 4Linux - Copy credentials and config files to mounted USB
Expected signal: Linux auditd syscall events: openat/read on /etc/passwd, /etc/shadow, ~/.ssh/id_rsa; write syscalls to /media/*/exfil/ paths. Syslog entries showing USB mount event (kernel: usb, scsi: sd). auditd EVENT_TYPE=PATH records for each file accessed. If auditd WATCH rules are configured on /etc/shadow and ~/.ssh/id_rsa, dedicated alerts fire for those accesses.
- Test 5Windows - PowerShell recursive file copy to USB simulating data collection script
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing '-ExecutionPolicy Bypass', 'Get-ChildItem', 'Copy-Item', and target drive 'E:\'. PowerShell ScriptBlock Logging Event ID 4104 with full deobfuscated script content. Sysmon Event ID 11: Multiple FileCreate events on E:\ps_exfil\ for each copied file. MDE DeviceFileEvents with ActionType=FileCreated on DriveLetter=E:.
References (12)
- https://attack.mitre.org/techniques/T1052/
- https://attack.mitre.org/techniques/T1052/001/
- https://learn.microsoft.com/en-us/defender-endpoint/device-control-removable-storage-access-control
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
- https://www.cisa.gov/sites/default/files/publications/fact-sheet-removable-media-508.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1052.001/T1052.001.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file
- https://www.mandiant.com/resources/blog/insider-threats-data-exfiltration
- https://www.sans.org/white-papers/33492/
- https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
Unlock Pro Content
Get the full detection package for T1052 including response playbook, investigation guide, and atomic red team tests.