tfMITRE ATT&CK technique

Data from Removable Media T1025

Tactic: Collection
Platforms: Linux, macOS, Windows
Version: 1.3
Created: 31 May 2017
Last modified: 24 October 2025
Contributor: William Cain

Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 17%

Tools & malware83rd percentile · 83% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

Data from Removable Media MITRE reference T1025

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

OilRigG0049 ↗

Has used Wireshark’s usbcapcmd utility to capture USB traffic.1

created 2017-12-141 referenceaka COBALT GYPSY

Gamaredon GroupG0047 ↗

A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.1 2 3

created 2017-05-313 referencesaka IRON TILDEN

TurlaG0010 ↗

RPC backdoors can collect files from USB thumb drives.1 2

created 2017-05-312 referencesaka IRON HUNTER

APT28G0007 ↗

An APT28 backdoor may collect the entire contents of an inserted USB device.1

created 2017-05-311 referenceaka IRON TWILIGHT

All 4 groups for this technique

Offense vs defense T1025

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 3

first rule: 2025 Q1

Data from Removable Media detection strategy DET0511

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Data Access and Collection from Removable Media

Enterprise

3 platforms

AN1410 · Windows

Adversary mounts a USB device and begins enumerating, copying, or compressing files using scripting engines, cmd, or remote access tools.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Drive CreationDC0042	WinEventLog:System	EventCode=2003
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
VolumeLabel	Can tune based on known removable device labels or whitelist
TimeWindow	Controls timing between device mount and sensitive file access
TargetFileType	Tune for sensitive file extensions (e.g., .docx, .pdf, .csv)

AN1411 · Linux

Adversary mounts external drive to /media or /mnt then accesses or copies targeted data via shell, cp, or tar.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Drive CreationDC0042	journald:systemd	udisks2 or udevd logs
File AccessDC0055	auditd:SYSCALL	open, read, mount

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MountPathRegex	Filter for unexpected or user-defined mount locations (e.g., /media/usb*)
AccessMask	Tune based on read/write access types seen during collection

AN1412 · macOS

Adversary attaches USB drive and accesses sensitive files using Finder, cp, or bash scripts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	process_events
Drive CreationDC0042	macos:unifiedlog	log stream --predicate 'eventMessage contains "USBMSC"'
File AccessDC0055	fs:fsusage	file reads/writes from /Volumes/

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
VolumePath	Tune by filtering removable media mounted under /Volumes
UserContext	Correlate activity to admin or service accounts for priority

Tests1Executorscmd 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	Identify Documents on USB and Removable Media via PowerShell	windows	cmd	—	—	—
This test simulates an attack where PowerShell is used to detect connected USB or other removable storage devices and gather a list of specific document files (e.g., .docx, .xls, .txt, .pdf). The command works by first identifying removable drives on the system and then recursively searching through each one for files matching the targeted extensions. If no removable drives are present, the script will return a message stating that no media is detected. This behavior mimics how adversaries might scan for sensitive documents on removable devices for exfiltration or analysis. Attack command powershell.exe -c "Get-Volume \| Where-Object {$_.DriveType -eq 'Removable'} \| ForEach-Object { Get-ChildItem -Path ($_.DriveLetter + ':\') -Recurse -Include '.doc','.xls','.txt','*.pdf' -ErrorAction SilentlyContinue \| ForEach-Object {Write-Output $_.FullName} } ; if (-not (Get-Volume \| Where-Object {$_.DriveType -eq 'Removable'})) { Write-Output 'No removable media.' }" GUID65a71b0d-52fc-4cd4-bad2-0aa59b1860cc

Tests from Atomic Red Team (MIT licence) · technique definition

Data from Removable Media detections T1025

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs