T0847 Replication Through Removable Media — Detection Rules

Source-backed rule directory

No reviewed association in this snapshot.

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0733 Detection of Replication Through Removable Media

AN1866 Analytic 1866

Real-time monitoring identifies a Universal Serial Bus (USB) storage device insertion event on an Industrial Control System (ICS) engineering or Human-Machine Interface (HMI) workstation where the device's hardware identifier (ID) is not in the authorized USB allowlist, immediately followed by process execution from the removable drive's path. Documented as the primary infection vector for Stuxnet, which specifically targeted air-gapped Siemens engineering environments via infected USB drives. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

AN2127 Analytic 2127

Real-time monitoring identifies a mount event for removable storage media on an Industrial Control System (ICS) Linux asset, followed by execution of a binary from the mounted path within a short window. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

AN2190 Analytic 2190

Real-time monitoring identifies a new device connecting to an Industrial Control System (ICS) network switch port that was previously unused or previously assigned to a different device Media Access Control (MAC) address immediately following physical access to the environment, with subsequent Industrial Control System (ICS) protocol traffic to field devices. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

AN2228 Analytic 2228

Real-time monitoring identifies an Industrial Control System (ICS) protocol file-transfer service such as Distributed Network Protocol 3 (DNP3) File Transfer Object or Internet Electrotechnical Commision (IEC) 61850 file service being used to place files on a field device from a source not in the approved engineering workstation list, outside a scheduled maintenance window, where the transfer source is a device not previously enrolled. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.