Techniques › T1092
T1092 Communication Through Removable Media
command and control — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1092
0
KEV CVEs mapped here
<p>Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system. Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by Replication Through Removable Media. Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0090 Cross-host C2 via Removable Media Relay v1.0
AN0247 WindowsBehavioral sequence where removable media is mounted, files are written/updated, and subsequently read/executed on a separate host, suggesting removable-media relay communication.Tunable:
RemovableDriveLetterWriteToReadTimeWindowFileNamePatternAN0248 LinuxDetection of file write-access to USB-mount directories (e.g., /media/, /run/media/) followed by same-file access or execution on another host.Tunable:MountPathPatternTimeWindowBetweenHostsAN0249 macOSCorrelates removable volume mounts (disk arbitration) with file I/O events on that volume, followed by same file execution shortly after insert.Tunable:VolumeNameFilterProcessContext
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1092
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.