MITRE ATT&CKtechnique

T1092 Communication Through Removable Media

Published 2017-05-31 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
Linux, macOS, Windows
Version
1.0
Created
2017-05-31

Description

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system. Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by Replication Through Removable Media. Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.

Related

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1042 Disable or Remove Feature or Program mitigation
  • M1028 Operating System Configuration mitigation

Referenced by MITRE ATT&CK · uses (3)

  • G0007 APT28 group
  • S0023 CHOPSTICK software (malware)
  • S0136 USBStealer software (malware)

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-457 USB Memory Attacks attack pattern

Referenced by Compliance · mitigates (9)

  • CIS-10.3 Disable Autorun and Autoplay for Removable Media CIS Safeguard v8.1
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-MP-7 Media Use NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References