Techniques › T1052.001 › AN0616
AN0616 Analytic 0616
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects USB device insertion followed by high-volume or sensitive file access and staging activity by suspicious processes or accounts.</p>
- Detects
- T1052.001 Exfiltration over USB
- Part of
- DET0220 Detection of USB-Based Data Exfiltration
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Security | EventCode=4663, 4670, 4656 | DC0055 File Access |
| WinEventLog:System | EventCode=2003 | DC0042 Drive Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
SensitiveFilePathRegex | Match data staging or export paths (e.g., *.docx, *.csv, *.db) to USB volume letters. |
UserContext | Limit to users who do not normally use removable devices (e.g., service accounts). |
TimeWindow | Correlate events within a short period following USB insert (e.g., 5–10 minutes). |