Communication Through Removable Media
- ID
- T1092
- Tactics
- TA0011 Command and Control
- Platforms
- Linux, macOS, Windows
- Data sources
- Drive Creation, File Creation, Process Creation
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.[3] Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by Replication Through Removable Media. Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
Detection
- DET0090 Cross-host C2 via Removable Media Relay
Data components: Drive Creation, File Creation, Process Creation
Mitigations (2)
- M1028 Operating System Configuration
Disallow or restrict removable media at an organizational policy level if they are not required for business operations.[1]
- M1042 Disable or Remove Feature or Program
Disable Autoruns if it is unnecessary.[2]
Groups (1)
Software (2)
References
- TechNet Removable Media Control
- Microsoft Disable Autorun
- ESET Sednit USBStealer 2014