Data Loss Prevention (DLP) involves implementing strategies and technologies to identify, categorize, monitor, and control the movement of sensitive data within an organization. This includes protecting data formats indicative of Personally Identifiable Information (PII), intellectual property, or financial data from unauthorized access, transmission, or exfiltration. DLP solutions integrate with network, endpoint, and cloud platforms to enforce security policies and prevent accidental or malicious data leaks. (Citation: PurpleSec Data Loss Prevention) This mitigation can be implemented through the following measures: Sensitive Data Categorization: - Use Case: Identify and classify data based on sensitivity (e.g., PII, financial data, trade secrets). - Implementation: Use DLP solutions to scan and tag files containing sensitive information using predefined patterns, such as Social Secur…
MITRE mitigation sourceAdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Data from Removable Media
Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information. Some adversaries may also use Automated Collection on removable media.
Open detection, hunting, mitigation, and evidence workspace
Detection logic
Monitor processes and command-line arguments for actions that could be taken to collect files from a system's connected removable media. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.
Observed actors
Correlated CTI and IR reports
Cyber Knowledge context
Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.
Digital Forensics & Incident Response (DFIR) · Governed topic match · 60/100Endpoint live response and volatile acquisition
Digital Forensics & Incident Response (DFIR) · Governed topic match · 51/100Memory forensics and runtime reconstruction
Digital Forensics & Incident Response (DFIR) · Governed topic match · 48/100Threat modeling and secure architecture
Secure Code & Application Security · Governed topic match · 42/100Input boundaries, injection prevention, and safe output
Secure Code & Application Security · Governed topic match · 42/100Files, parsers, serialization, URL fetching, and isolation
Secure Code & Application Security · Governed topic match · 42/100Dynamic testing, fuzzing, abuse simulation, and security regression
Secure Code & Application Security · Governed topic match · 42/100Incident declaration, triage, scope, and hypotheses
Digital Forensics & Incident Response (DFIR) · Governed topic match · 42/100Network, DNS, proxy, VPN, and email forensics
Digital Forensics & Incident Response (DFIR) · Governed topic match · 42/100Containment, eradication, recovery, communications, and closure
Digital Forensics & Incident Response (DFIR) · Governed topic match · 42/100Post-incident learning and controlled AI/RAG/MCP assistance
Digital Forensics & Incident Response (DFIR) · Governed topic match · 42/100Code review, SAST, SCA, secrets, IaC, and container analysis
Secure Code & Application Security · Governed topic match · 30/100
MITRE mitigations
MITRE detection strategies and analytics
- AN1410 · Analytic 1410 — Adversary mounts a USB device and begins enumerating, copying, or compressing files using scripting engines, cmd, or remote access tools.
- AN1411 · Analytic 1411 — Adversary mounts external drive to /media or /mnt then accesses or copies targeted data via shell, cp, or tar.
- AN1412 · Analytic 1412 — Adversary attaches USB drive and accesses sensitive files using Finder, cp, or bash scripts.