{"id":"T1092","name":"Communication Through Removable Media","url":"https://attack.mitre.org/techniques/T1092","tactics":["command-and-control"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0090","stix_id":"x-mitre-detection-strategy--2cbbc0b5-2c4b-4861-91d3-1f64a47ef191","name":"Cross-host C2 via Removable Media Relay","url":"https://attack.mitre.org/detectionstrategies/DET0090","analytics":[{"id":"AN0247","stix_id":"x-mitre-analytic--b355ae5d-3cd6-4594-8bd9-8fed59e02326","name":"Analytic 0247","description":"Behavioral sequence where removable media is mounted, files are written/updated, and subsequently read/executed on a separate host, suggesting removable-media relay communication.","url":"https://attack.mitre.org/detectionstrategies/DET0090#AN0247","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:System","channel":"EventCode=1006","data_component":"DC0042","data_component_name":"Drive Creation","log_source_slug":"wineventlog-system"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"RemovableDriveLetter","description":"Adjust drive letters used in detection (e.g., E:, F:, G:) depending on enterprise usage."},{"field":"WriteToReadTimeWindow","description":"Tunable window for file write on one host followed by file read or execution on another (e.g., within 10 minutes)."},{"field":"FileNamePattern","description":"Common naming schemes for payload, tasking, or exfil files (e.g., task.txt, beacon.log, data.bin)."}],"live":true,"detection_strategies":["DET0090"],"techniques":["T1092"]},{"id":"AN0248","stix_id":"x-mitre-analytic--6f8fdb88-56d1-454e-9a35-3b7170011ca2","name":"Analytic 0248","description":"Detection of file write-access to USB-mount directories (e.g., /media/, /run/media/) followed by same-file access or execution on another host.","url":"https://attack.mitre.org/detectionstrategies/DET0090#AN0248","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"write/open, FIM audit","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"Removable media mount notification","data_component":"DC0042","data_component_name":"Drive Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"MountPathPattern","description":"Typical mount paths to monitor (e.g., /media/usb*, /run/media/username/*)."},{"field":"TimeWindowBetweenHosts","description":"Tunable detection window to correlate read/write between different hosts within a short interval (e.g., <15m)."}],"live":true,"detection_strategies":["DET0090"],"techniques":["T1092"]},{"id":"AN0249","stix_id":"x-mitre-analytic--bb687663-4b26-46ef-a176-e188f538d399","name":"Analytic 0249","description":"Correlates removable volume mounts (disk arbitration) with file I/O events on that volume, followed by same file execution shortly after insert.","url":"https://attack.mitre.org/detectionstrategies/DET0090#AN0249","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"com.apple.diskarbitration","data_component":"DC0042","data_component_name":"Drive Creation","log_source_slug":"macos-unifiedlog"},{"name":"fs:fsusage","channel":"open/write/exec calls","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"fs-fsusage"}],"mutable_elements":[{"field":"VolumeNameFilter","description":"Known suspicious USB volume labels or types (e.g., NO NAME, SECUREDATA)."},{"field":"ProcessContext","description":"Unusual processes accessing USB drives (e.g., bash, Python, unsigned binaries)."}],"live":true,"detection_strategies":["DET0090"],"techniques":["T1092"]}],"live":true,"version":"1.0","techniques":["T1092"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}