{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1092","id":"T1092","name":"Communication Through Removable Media","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1092","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"07430415ccca44e1261ce272d2dc30810b45c5eae44cc3d78b45e6c513eccfe3","description":"Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1092","external_id":"T1092"},{"source_name":"ESET Sednit USBStealer 2014","description":"Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017.","url":"http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0042","name":"Drive Creation","page":"telemetry/DC0042/","kind":"attack_component","category":"Host state and inventory","description":"Appearance or creation of a drive/device mapping on a host.","collection_focus":"Collect OS device/mount events plus read-only volume inventory; distinguish physical attachment, partition creation and logical mapping.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["device_id","mount_point","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0042","collector":"illustrative-lab-collector","observation":{"device_id":"lab-disk-2","mount_point":"/mnt/lab","action":"attach"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1092","id":"T1092","name":"Communication Through Removable Media","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1092","technique_page":"techniques/enterprise/T1092/","page":"detections/enterprise/T1092/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0090","name":"Cross-host C2 via Removable Media Relay","url":"https://attack.mitre.org/detectionstrategies/DET0090","stix_id":"x-mitre-detection-strategy--2cbbc0b5-2c4b-4861-91d3-1f64a47ef191","relationship_id":"relationship--2a15d658-c99d-4291-a5d1-4c27ade7b697","description":"","analytics":[{"id":"AN0247","name":"Analytic 0247","guidance":"Behavioral sequence where removable media is mounted, files are written/updated, and subsequently read/executed on a separate host, suggesting removable-media relay communication.","url":"https://attack.mitre.org/detectionstrategies/DET0090#AN0247","platforms":["Windows"],"tuning":[{"field":"RemovableDriveLetter","description":"Adjust drive letters used in detection (e.g., E:, F:, G:) depending on enterprise usage."},{"field":"WriteToReadTimeWindow","description":"Tunable window for file write on one host followed by file read or execution on another (e.g., within 10 minutes)."},{"field":"FileNamePattern","description":"Common naming schemes for payload, tasking, or exfil files (e.g., task.txt, beacon.log, data.bin)."}],"log_sources":[{"component_id":"DC0042","component":"Drive Creation","name":"WinEventLog:System","channel":"EventCode=1006","platforms":["Windows"],"analytic_id":"AN0247","source_url":"https://attack.mitre.org/detectionstrategies/DET0090#AN0247","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0042/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN0247","source_url":"https://attack.mitre.org/detectionstrategies/DET0090#AN0247","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0247","source_url":"https://attack.mitre.org/detectionstrategies/DET0090#AN0247","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0248","name":"Analytic 0248","guidance":"Detection of file write-access to USB-mount directories (e.g., /media/, /run/media/) followed by same-file access or execution on another host.","url":"https://attack.mitre.org/detectionstrategies/DET0090#AN0248","platforms":["Linux"],"tuning":[{"field":"MountPathPattern","description":"Typical mount paths to monitor (e.g., /media/usb*, /run/media/username/*)."},{"field":"TimeWindowBetweenHosts","description":"Tunable detection window to correlate read/write between different hosts within a short interval (e.g., <15m)."}],"log_sources":[{"component_id":"DC0039","component":"File Creation","name":"auditd:SYSCALL","channel":"write/open, FIM audit","platforms":["Linux"],"analytic_id":"AN0248","source_url":"https://attack.mitre.org/detectionstrategies/DET0090#AN0248","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0042","component":"Drive Creation","name":"auditd:SYSCALL","channel":"Removable media mount notification","platforms":["Linux"],"analytic_id":"AN0248","source_url":"https://attack.mitre.org/detectionstrategies/DET0090#AN0248","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0042/"}]},{"id":"AN0249","name":"Analytic 0249","guidance":"Correlates removable volume mounts (disk arbitration) with file I/O events on that volume, followed by same file execution shortly after insert.","url":"https://attack.mitre.org/detectionstrategies/DET0090#AN0249","platforms":["macOS"],"tuning":[{"field":"VolumeNameFilter","description":"Known suspicious USB volume labels or types (e.g., NO NAME, SECUREDATA)."},{"field":"ProcessContext","description":"Unusual processes accessing USB drives (e.g., bash, Python, unsigned binaries)."}],"log_sources":[{"component_id":"DC0042","component":"Drive Creation","name":"macos:unifiedlog","channel":"com.apple.diskarbitration","platforms":["macOS"],"analytic_id":"AN0249","source_url":"https://attack.mitre.org/detectionstrategies/DET0090#AN0249","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0042/"},{"component_id":"DC0039","component":"File Creation","name":"fs:fsusage","channel":"open/write/exec calls","platforms":["macOS"],"analytic_id":"AN0249","source_url":"https://attack.mitre.org/detectionstrategies/DET0090#AN0249","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"}]}]}],"telemetry_references":[{"id":"DC0042","name":"Drive Creation","tag":"Drive Creation","page":"telemetry/DC0042/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0023","name":"CHOPSTICK","url":"https://attack.mitre.org/software/S0023","kind":"malware","description":"Part of [APT28](https://attack.mitre.org/groups/G0007)'s operation involved using [CHOPSTICK](https://attack.mitre.org/software/S0023) modules to copy itself to air-gapped machines, using files written to USB sticks to transfer data and command traffic.(Citation: FireEye APT28)(Citation: ESET Sednit Part 2)(Citation: Microsoft SIR Vol 19)","relationship_id":"relationship--167d7b11-01f3-42d5-bb8a-78306dc80243","references":[{"source_name":"Microsoft SIR Vol 19","description":"Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.","url":"http://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf"},{"source_name":"ESET Sednit Part 2","description":"ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"},{"source_name":"FireEye APT28","description":"FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"}]},{"id":"S0136","name":"USBStealer","url":"https://attack.mitre.org/software/S0136","kind":"malware","description":"[USBStealer](https://attack.mitre.org/software/S0136) drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim.(Citation: ESET Sednit USBStealer 2014)","relationship_id":"relationship--c612eb88-d7e0-46cc-a9bc-d0da2977ff00","references":[{"source_name":"ESET Sednit USBStealer 2014","description":"Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017.","url":"http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/"}]}],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) uses a tool that captures information from air-gapped computers via an infected USB and transfers it to network-connected computer when the USB is inserted.(Citation: Microsoft SIR Vol 19)","relationship_id":"relationship--c569059f-8a7d-4777-a111-d3ab62d178ca","references":[{"source_name":"Microsoft SIR Vol 19","description":"Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.","url":"http://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf"}]}],"mitigations":[{"id":"M1028","name":"Operating System Configuration","url":"https://attack.mitre.org/mitigations/M1028","kind":"course-of-action","description":"Disallow or restrict removable media at an organizational policy level if they are not required for business operations.(Citation: TechNet Removable Media Control)","relationship_id":"relationship--c4b3287c-5e5a-4ec0-bc20-4e3b6a0c296f","references":[{"source_name":"TechNet Removable Media Control","description":"Microsoft. (2007, August 31). https://technet.microsoft.com/en-us/library/cc771759(v=ws.10).aspx. Retrieved April 20, 2016.","url":"https://technet.microsoft.com/en-us/library/cc772540(v=ws.10).aspx"}]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Disable Autoruns if it is unnecessary.(Citation: Microsoft Disable Autorun)","relationship_id":"relationship--8506f2ac-e856-4d13-ac7e-fc88c4ec3c15","references":[{"source_name":"Microsoft Disable Autorun","description":"Microsoft. (n.d.). How to disable the Autorun functionality in Windows. Retrieved April 20, 2016.","url":"https://support.microsoft.com/en-us/kb/967715"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1091":"/ttp-simulation/techniques/enterprise/T1091/","T1092":"/ttp-simulation/techniques/enterprise/T1092/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1092","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0042","collector":"illustrative-lab-collector","observation":{"device_id":"lab-disk-2","mount_point":"/mnt/lab","action":"attach"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}