Techniques › T1025
T1025 Data from Removable Media
collection — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1025
0
KEV CVEs mapped here
<p>Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.</p><p>Some adversaries may also use Automated Collection on removable media.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0511 Detection of Data Access and Collection from Removable Media v1.0
AN1410 WindowsAdversary mounts a USB device and begins enumerating, copying, or compressing files using scripting engines, cmd, or remote access tools.Tunable:
VolumeLabelTimeWindowTargetFileTypeAN1411 LinuxAdversary mounts external drive to /media or /mnt then accesses or copies targeted data via shell, cp, or tar.Tunable:MountPathRegexAccessMaskAN1412 macOSAdversary attaches USB drive and accesses sensitive files using Finder, cp, or bash scripts.Tunable:VolumePathUserContext
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1025
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.