Communication Through Removable Media
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
The defining property of this technique is a relay across two hosts — a tasking or result file written to removable media on host A, then read or executed from that same media on host B — and every analytic in DET0090 says so explicitly. Both of MITRE's tuning knobs for the correlation, WriteToReadTimeWindow on AN0247 and TimeWindowBetweenHosts on AN0248, are windows for joining events from different machines, and lib/sigma models no timeframe, no aggregation and no cross-source join, so the one thing that makes this T1092 rather than any other removable-media technique cannot be written. What survives on a single event is only 'a volume was mounted' or 'a file was written to a removable volume', and neither carries any field distinguishing C2 tasking from exfiltration or from worm propagation. […]
What the technique is
Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system. Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by Replication Through Removable Media. Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0247
Behavioral sequence where removable media is mounted, files are written/updated, and subsequently read/executed on a separate host, suggesting removable-media relay communication.
- AN0248
Detection of file write-access to USB-mount directories (e.g., /media/, /run/media/) followed by same-file access or execution on another host.
- AN0249
Correlates removable volume mounts (disk arbitration) with file I/O events on that volume, followed by same file execution shortly after insert.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.