Description
Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by Replication Through Removable Media. Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
Platforms
Mitigations (2)
Disable or Remove Feature or ProgramM1042
Disable Autoruns if it is unnecessary.(Citation: Microsoft Disable Autorun)
Operating System ConfigurationM1028
Disallow or restrict removable media at an organizational policy level if they are not required for business operations.(Citation: TechNet Removable Media Control)
Threat Groups (1)
| ID | Group | Context |
|---|---|---|
| G0007 | APT28 | [APT28](https://attack.mitre.org/groups/G0007) uses a tool that captures information from air-gapped computers via an infected USB and transfers it to... |
Associated Software (2)
| ID | Name | Type | Context |
|---|---|---|---|
| S0023 | CHOPSTICK | Malware | Part of [APT28](https://attack.mitre.org/groups/G0007)'s operation involved using [CHOPSTICK](https://attack.mitre.org/software/S0023) modules to copy... |
| S0136 | USBStealer | Malware | [USBStealer](https://attack.mitre.org/software/S0136) drops commands for a second victim onto a removable media drive inserted into the first victim, ... |
References
Frequently Asked Questions
What is T1092 (Communication Through Removable Media)?
T1092 is a MITRE ATT&CK technique named 'Communication Through Removable Media'. It belongs to the Command and Control tactic(s). Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBSt...
How can T1092 be detected?
Detection of T1092 (Communication Through Removable Media) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1092?
There are 2 documented mitigations for T1092. Key mitigations include: Disable or Remove Feature or Program, Operating System Configuration.
Which threat groups use T1092?
Known threat groups using T1092 include: APT28.