Techniques › T1052 › AN0344
AN0344 Analytic 0344
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects mounting of external volumes followed by high-volume or sensitive file access via Finder, terminal, or third-party apps (e.g., rsync, zip).</p>
- Detects
- T1052 Exfiltration Over Physical Medium
- Part of
- DET0123 Detection of Data Exfiltration via Removable Media
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | Volume Mount + File Read | DC0042 Drive Creation |
| macos:osquery | file_events | DC0055 File Access |
| fs:fsusage | file system activity monitor | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
VolumeNamePattern | Detect suspicious or unrecognized drive labels (e.g., UNTITLED, BACKUP_VOL). |
ProcessOrigin | Detect CLI-based copy operations vs. expected GUI usage. |
UserSessionCheck | Alert if process and session context are mismatched (e.g., script from screensaver context). |