Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1025

Data from Removable Media

Linux · macOS · Windowsnothing on this site yetT1025 on attack.mitre.org

Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information. Some adversaries may also use Automated Collection on removable media.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

how MITRE says to see it

Detection of Data Access and Collection from Removable Media

  • Adversary mounts a USB device and begins enumerating, copying, or compressing files using scripting engines, cmd, or remote access tools.
  • Adversary mounts external drive to /media or /mnt then accesses or copies targeted data via shell, cp, or tar.
  • Adversary attaches USB drive and accesses sensitive files using Finder, cp, or bash scripts.

what reduces it

  • M1057 Data Loss Prevention. Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.