Wiki › Techniques, Tactics & Procedures (TTPs) › Exfiltration › Physical Media Data Exfiltration

Physical Media Data Exfiltration

2 min read

Jump to:

Overview

Physical Media Data Exfiltration is a technique where adversaries transfer sensitive or valuable data from a compromised environment onto removable physical storage devices. This method is often employed during the exfiltration phase of an attack lifecycle to bypass network-based detection and controls. Adversaries use physical media to stealthily remove data, especially in environments with stringent network monitoring or air-gapped systems.

Attack Objective

Primary goal: Data theft and unauthorized data transfer
Attack lifecycle stage: Exfiltration
Advances attacker position by enabling covert removal of information without relying on network channels, reducing detection risk and facilitating data extraction from isolated or heavily monitored environments

How the Technique Works

Adversaries copy or move data from target systems onto physical storage devices such as USB flash drives, external hard drives, CDs, or other removable media. This may occur directly on compromised endpoints or through intermediary systems. The physical transfer circumvents network security controls and can be conducted manually or automated using scripts or malware designed to interact with removable media.

Common Methods & Variations

Use of USB drives, external SSDs/HDDs, optical media, or SD cards
Applicable in on-premises environments and air-gapped networks where network exfiltration is impractical
Living-off-the-land approaches leveraging native OS commands and utilities to copy data versus custom malware designed for automated exfiltration

Indicators of Compromise (IOCs)

Logs showing mounting or unmounting of removable media devices
Unusual file access patterns or large data transfers to removable drives
Endpoint alerts for insertion/removal of physical media outside normal operational hours
Audit logs capturing USB device usage or policy violations

Detection Strategies

Endpoint telemetry monitoring device connection events and file system activity
Behavioral detection focusing on anomalous data copying or device usage patterns
Correlation of physical media events with user activity and access logs to identify suspicious behavior

Mitigation & Prevention

Enforce strict removable media usage policies and device control mechanisms
Implement endpoint security solutions with USB device management and data loss prevention (DLP) capabilities
Apply least privilege principles to restrict user access to removable media
Use encryption and access controls on sensitive data to reduce value if exfiltrated

Response Considerations

Immediately isolate affected systems and disable removable media ports if possible
Conduct forensic analysis of endpoint logs and device usage history to identify scope and timeline
Review and strengthen removable media policies and endpoint controls post-incident
Educate users on risks and enforce compliance with physical media restrictions

Related Techniques

Network-based Data Exfiltration methods
Data Staged for Exfiltration prior to physical transfer
Credential Access to enable unauthorized use of removable media

Mapping & References

MITRE ATT&CK: Exfiltration Over Physical Medium (T1052)
Public advisories on data loss prevention and removable media security best practices
Incident reports highlighting use of physical media in targeted data theft operations

Tags: Attack Lifecycle data loss prevention data theft endpoint security Exfiltration MITRE ATT&CK removable media USB