Cross-source coverage

T1025 / ATT&CK

Data from Removable Media

4 rules across 2 sources.

From MITRE ATT&CK 19.2

Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.

Some adversaries may also use Automated Collection on removable media.

Tactics
Collection
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:SystemWinEventLog:Sysmonauditd:SYSCALLjournald:systemdmacos:unifiedlogfs:fsusagemacos:osquery

How MITRE says to detect it DET0511

Detection of Data Access and Collection from Removable Media

Windows Analytic 1410

Adversary mounts a USB device and begins enumerating, copying, or compressing files using scripting engines, cmd, or remote access tools.

  • WinEventLog:Security EventCode=4663, 4670, 4656
  • WinEventLog:System EventCode=2003
  • WinEventLog:Sysmon EventCode=1

Linux Analytic 1411

Adversary mounts external drive to /media or /mnt then accesses or copies targeted data via shell, cp, or tar.

  • auditd:SYSCALL open, read, mount
  • journald:systemd udisks2 or udevd logs
  • auditd:SYSCALL execve

macOS Analytic 1412

Adversary attaches USB drive and accesses sensitive files using Finder, cp, or bash scripts.

  • macos:unifiedlog log stream --predicate 'eventMessage contains "USBMSC"'
  • fs:fsusage file reads/writes from /Volumes/
  • macos:osquery process_events

View on attack.mitre.org ↗

splunk/security_content

3 rules
Detection Severity Format
Windows Process Executed From Removable Media Undefined SPL
Windows USBSTOR Registry Key Modification Undefined SPL
Windows WPDBusEnum Registry Key Modification Undefined SPL

socfortress/Wazuh-Rules

1 rule
Detection Severity Format
Sysmon - Event 1: Process creation · PowerShell Search Removable Media (T1025) High Wazuh XML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.