T1092

Communication Through Removable Media

Linux · macOS · Windowsnothing on this site yetT1092 on attack.mitre.org

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system. Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by Replication Through Removable Media.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Cross-host C2 via Removable Media Relay

Behavioral sequence where removable media is mounted, files are written/updated, and subsequently read/executed on a separate host, suggesting removable-media relay communication.
Detection of file write-access to USB-mount directories (e.g., /media/, /run/media/) followed by same-file access or execution on another host.
Correlates removable volume mounts (disk arbitration) with file I/O events on that volume, followed by same file execution shortly after insert.

what reduces it

M1028 Operating System Configuration. Disallow or restrict removable media at an organizational policy level if they are not required for business operations.
M1042 Disable or Remove Feature or Program. Disable Autoruns if it is unnecessary.

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.