Exfiltration over USB
Subtechnique · ATTACK:enterprise:T1052.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1052.001",
"title": "Exfiltration over USB",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1052/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--a3e1e6c5-9c74-4fc0-a16c-a9d228c17829",
"external_id": "T1052.001",
"domain": "enterprise",
"created": "2020-03-11T13:50:11.467Z",
"modified": "2026-09-02T18:41:21.426Z",
"version": "1.3",
"aliases": [
],
"tactics": [
"exfiltration"
],
"source_references": [
{
"source_name": "A USB data exfiltration case study",
"url": "https://www.cell.com/heliyon/fulltext/S2405-8440(23)00232-3"
}
]
}Explicit source assertions (11)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0035 → uses → ATTACK:enterprise:T1052.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04e2c418-8f6c-453c-8e17-4d3aeec0f755
FireEye APT30ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1052.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--137e1ddc-403b-49b5-a214-20b82bab446e
Kaspersky ProjectSauron Full ReportATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1052.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b97e16e-8c39-4e5e-ad90-15c10f15d923
ESET Sednit USBStealer 2014ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1052.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--553aadc2-8c1c-4ad7-b974-c65f99f6a892
Microsoft Disable Autorun · TechNet Removable Media ControlATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1052.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6971d7f3-8161-4399-b587-acab5d8820f1
TrendMicro Tropic Trooper May 2020ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1052.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f8d9c8d-750d-40c2-9722-c000b1efda13
Avira Mustang Panda January 2020ATTACK:enterprise:S0092 → uses → ATTACK:enterprise:T1052.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b96fb11-8b54-4bed-9e6c-cd93b29c5c20
Securelist Agent.btzATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1052.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ceaecae-f85d-4eb7-a518-fb98b2b71c66
ESET Machete July 2019 · Securelist Machete Aug 2014ATTACK:enterprise:T1052.001 → subtechnique-of → ATTACK:enterprise:T1052
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d7be380-2dee-4f74-9464-1dea3c8ca6f4
ATTACK:enterprise:M1034 → mitigates → ATTACK:enterprise:T1052.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2b112f8-27ed-449c-a9e1-e984139ee9f2
ATTACK:enterprise:M1057 → mitigates → ATTACK:enterprise:T1052.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1c6ae29-cbe2-46f1-b415-fe39fd419a6e