MITRE ATT&CKtechnique

T1025 Data from Removable Media

Published 2017-05-31 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Collection
Platforms
Linux, macOS, Windows
Version
1.3
Created
2017-05-31

Description

Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information. Some adversaries may also use Automated Collection on removable media.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1057 Data Loss Prevention mitigation

Referenced by MITRE ATT&CK · uses (24)

  • S1146 MgBot software (malware)
  • S1044 FunnyDream software (malware)
  • S0644 ObliqueRAT software (malware)
  • S0622 AppleSeed software (malware)
  • S0569 Explosive software (malware)
  • S0538 Crutch software (malware)
  • S0467 TajMahal software (malware)
  • S0458 Ramsay software (malware)
  • S0456 Aria-body software (malware)
  • S0409 Machete software (malware)
  • S0237 GravityRAT software (malware)
  • S0260 InvisiMole software (malware)
  • G0049 OilRig group
  • G0007 APT28 group
  • G0010 Turla group
  • G0047 Gamaredon Group group
  • S0036 FLASHFLOOD software (malware)
  • S0050 CosmicDuke software (malware)
  • S0090 Rover software (malware)
  • S0113 Prikormka software (malware)
  • S0115 Crimson software (malware)
  • S0125 Remsec software (malware)
  • S0128 BADNEWS software (malware)
  • S0136 USBStealer software (malware)

Referenced by Compliance · mitigates (17)

  • CIS-3.6 Encrypt Data on End-User Devices CIS Safeguard v8.1
  • CIS-3.9 Encrypt Data on Removable Media CIS Safeguard v8.1
  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-23 Data Mining Protection NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-12 Information Location NIST 800-53 control
  • NIST-CP-9 System Backup NIST 800-53 control
  • NIST-MP-7 Media Use NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-13 Cryptographic Protection NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-38 Operations Security NIST 800-53 control
  • NIST-SC-41 Port and I/O Device Access NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control