tfMITRE ATT&CK technique

Replication Through Removable Media T1091

Tactics: Initial Access, Lateral Movement
Platform: Windows
Version: 1.3
Created: 31 May 2017
Last modified: 24 October 2025
Contributor: Joas Antonio dos Santos, @C0d3Cr4zy

Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 21%

Threat groups79th percentile · 79% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 17%

Tools & malware83rd percentile · 83% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules64th pct

Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.

Replication Through Removable Media MITRE reference T1091

Top 21%of all ATT&CK techniques for number of groups

8 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

LuminousMothG1014 ↗

Has used malicious DLLs to spread malware to connected removable USB drives on infected machines.1 2

created 2023-02-232 references

Aoqin DragonG1007 ↗

Has used a dropper that employs a worm infection strategy using a removable device to breach a secure network environment.1

created 2022-07-141 reference

Mustang PandaG0129 ↗

Has used a customized PlugX variant which could spread through USB connections.1

created 2021-04-121 referenceaka TA416

Tropic TrooperG0081 ↗

Has attempted to transfer USBferry from an infected USB device by copying an Autorun function to the target machine.1

created 2019-01-291 referenceaka Pirate Panda

Gamaredon GroupG0047 ↗

Has replicated to removable media by leveraging the User Assist Reg Key and creating LNKs on all network and removable drives available on the infected host.1

created 2017-05-311 referenceaka IRON TILDEN

FIN7G0046 ↗

Actors have mailed USB drives to potential victims containing malware that downloads and installs various backdoors, including in some cases for ransomware operations.1 Additionally, FIN7 has used malicious USBs that acted as virtual keyboards to install malware and txt files that decode to PowerShell commands.2

created 2017-05-312 referencesaka GOLD NIAGARA

All 8 groups for this technique · 6 newest in this preview

20 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

HIUPANS1230 ↗

Has periodically checked for removable and hot-plugged drives connected to the infected machine, should one be found HIUPAN will propagate to the removeable drives by copying itself and accompanying malware components to a directory to the new drive in a hidden subdirectory <Drive_Letter>:\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\ and hides any other existing files to ensure UsbConfig.exe is the only visible file on the device.1 2

created 2025-08-06MALWAREcarried by 1 group

Raspberry RobinS1130 ↗

Has historically used infected USB media to spread to new victims.1 2

created 2024-05-17MALWARE

ANDROMEDAS1074 ↗

Has been spread via infected USB keys.1

created 2023-05-16MALWARE

QakBotS0650 ↗

Has the ability to use removable drives to spread through compromised networks.1

created 2021-09-27MALWAREcarried by 3 groups

ConfickerS0608 ↗

Variants used the Windows AUTORUN feature to spread through USB propagation.1 2

created 2021-02-23MALWARE

StuxnetS0603 ↗

Can propagate via removable media using an autorun.inf file or the CVE-2010-2568 LNK vulnerability.1

created 2020-12-14MALWARE

All 20 software entries for this technique · 6 newest in this preview

Offense vs defense T1091

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 4

first rule: 2019 Q4

Replication Through Removable Media detection strategy DET0301

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Removable Media Execution Chain Detection via File and Process Activity

Enterprise

1 platform

AN0841 · Windows

Execution of files originating from removable media after drive mount, with correlation to file write activity, autorun usage, or lateral spread via staged tools.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Drive CreationDC0042	WinEventLog:System	EventCode=1006
File AccessDC0055	WinEventLog:Microsoft-Windows-Windows Defender/Operational	Suspicious file execution on removable media path

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DriveLetterMatch	Detect activity on mounted drives typically used by USB (e.g., E:, F:, G:). Tune based on enterprise usage.
FileExecutionWindow	Set timing threshold for execution shortly after drive mount (e.g., < 5 minutes).
ParentProcess	Restrict detection to suspicious process lineage like explorer.exe, powershell.exe, or unsigned binaries.
FileEntropy	Use entropy thresholding to detect packed/obfuscated payloads dropped to removable media.

Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites0Have cleanup1Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	USB Malware Spread Simulation	windows	PowerShell	—	—	Yes
Simulates an adversary copying malware to all connected removable drives. Attack command $RemovableDrives=@() $RemovableDrives = Get-WmiObject -Class Win32_LogicalDisk -filter "drivetype=2" \| select-object -expandproperty DeviceID ForEach ($Drive in $RemovableDrives) { write-host "Removable Drive Found:" $Drive New-Item -Path $Drive/T1091Test1.txt -ItemType "file" -Force -Value "T1091 Test 1 has created this file to simulate malware spread to removable drives." } Cleanup command $RemovableDrives = Get-WmiObject -Class Win32_LogicalDisk -filter "drivetype=2" \| select-object -expandproperty DeviceID ForEach ($Drive in $RemovableDrives) { Remove-Item -Path $Drive\T1091Test1.txt -Force -ErrorAction Ignore } GUID066f6d35-992d-43a4-876a-284567ad300c

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

USB Malware Spread Simulation

windows

PowerShell

—

Yes

Tests from Atomic Red Team (MIT licence) · technique definition

Replication Through Removable Media detections T1091

5 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

64th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs