Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

Subissues

Issuelinks
Bezeichnung Beschreibung
Exfiltration over USB Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

Linked Issues

Issuelinks
Linktyp Issue
is related to Techniques
is blocked by Data Loss Prevention
is blocked by Limit Hardware Installation
is blocked by Detection of Data Exfiltration via Removable Media
is blocked by Disable or Remove Feature or Program
is blocked by Asset Inventories
is blocked by Provenance
is blocked by Security, Compliance & Resilience Controls Oversight
is blocked by Secure Baseline Configurations
is blocked by Least Functionality
is blocked by Continuous Monitoring
is blocked by Encrypting Data At Rest
is blocked by Cybersecurity & Data Protection Attributes
is blocked by Media Use
is blocked by Use of External Technology Assets, Applications and/or Services (TAAS)
is blocked by Data Mining Protection
is blocked by Malicious Code Protection (Anti-Malware)
is blocked by Port & Input / Output (I/O) Device Access
is blocked by Account Management
is blocked by Access Enforcement
is blocked by Least Privilege
is blocked by Secure Engineering Principles
is blocked by Vulnerability Scanning
Impressum Deutsch Englisch