Cross-source coverage
T1092 / ATT&CK
Communication Through Removable Media
1 rule across 1 source.
From MITRE ATT&CK 19.2
Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system. Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by Replication Through Removable Media. Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
- Tactics
- Command and Control
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SystemWinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlogfs:fsusage
How MITRE says to detect it DET0090
Cross-host C2 via Removable Media Relay
Windows Analytic 0247
Behavioral sequence where removable media is mounted, files are written/updated, and subsequently read/executed on a separate host, suggesting removable-media relay communication.
WinEventLog:SystemEventCode=1006WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=1
Linux Analytic 0248
Detection of file write-access to USB-mount directories (e.g., /media/, /run/media/) followed by same-file access or execution on another host.
auditd:SYSCALLwrite/open, FIM auditauditd:SYSCALLRemovable media mount notification
macOS Analytic 0249
Correlates removable volume mounts (disk arbitration) with file I/O events on that volume, followed by same file execution shortly after insert.
macos:unifiedlogcom.apple.diskarbitrationfs:fsusageopen/write/exec calls
Wazuh Core Ruleset
1 rule| Detection | Severity | Format |
|---|---|---|
| A new external device was recognized by the system | Medium | Wazuh XML |