tfMITRE ATT&CK technique

Communication Through Removable Media T1092

Tactic: Command and Control
Platforms: Linux, macOS, Windows
Version: 1.0
Created: 31 May 2017
Last modified: 24 October 2025

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.[1] Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by Replication Through Removable Media. Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Communication Through Removable Media MITRE reference T1092

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT28G0007 ↗

Uses a tool that captures information from air-gapped computers via an infected USB and transfers it to network-connected computer when the USB is inserted.1

created 2017-05-311 referenceaka IRON TWILIGHT

All 1 groups for this technique

Offense vs defense T1092

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Communication Through Removable Media detection strategy DET0090

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Cross-host C2 via Removable Media Relay

Enterprise

3 platforms

AN0247 · Windows

Behavioral sequence where removable media is mounted, files are written/updated, and subsequently read/executed on a separate host, suggesting removable-media relay communication.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Drive CreationDC0042	WinEventLog:System	EventCode=1006

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RemovableDriveLetter	Adjust drive letters used in detection (e.g., E:, F:, G:) depending on enterprise usage.
WriteToReadTimeWindow	Tunable window for file write on one host followed by file read or execution on another (e.g., within 10 minutes).
FileNamePattern	Common naming schemes for payload, tasking, or exfil files (e.g., task.txt, beacon.log, data.bin).

AN0248 · Linux

Detection of file write-access to USB-mount directories (e.g., /media/, /run/media/) followed by same-file access or execution on another host.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	auditd:SYSCALL	write/open, FIM audit
Drive CreationDC0042	auditd:SYSCALL	Removable media mount notification

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MountPathPattern	Typical mount paths to monitor (e.g., /media/usb, /run/media/username/).
TimeWindowBetweenHosts	Tunable detection window to correlate read/write between different hosts within a short interval (e.g., <15m).

AN0249 · macOS

Correlates removable volume mounts (disk arbitration) with file I/O events on that volume, followed by same file execution shortly after insert.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	fs:fsusage	open/write/exec calls
Drive CreationDC0042	macos:unifiedlog	com.apple.diskarbitration

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
VolumeNameFilter	Known suspicious USB volume labels or types (e.g., NO NAME, SECUREDATA).
ProcessContext	Unusual processes accessing USB drives (e.g., bash, Python, unsigned binaries).

Communication Through Removable Media detections T1092

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs