Data from Removable Media
- ID
- T1025
- Tactics
- TA0009 Collection
- Platforms
- Linux, macOS, Windows
- Data sources
- File Access, Drive Creation, Process Creation
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.
Some adversaries may also use Automated Collection on removable media.
Detection
- DET0511 Detection of Data Access and Collection from Removable Media
Data components: File Access, Drive Creation, Process Creation
Mitigations (1)
- M1057 Data Loss Prevention
Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.