Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.
Some adversaries may also use Automated Collection on removable media.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-3.9 | Encrypt Data on Removable Media | mitigates | T1025 | Data from Removable Media |
Comments
The safeguard explicitly protects removable-media-stored data from unauthorized access.
References
|
| CIS-3.6 | Encrypt Data on End-User Devices | mitigates | T1025 | Data from Removable Media |
Comments
Encryption protects copied endpoint data stored on removable media from unauthorized disclosure.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.malware.variety.Capture stored data | Capture data stored on system disk | related-to | T1025 | Data from Removable Media | |
| attribute.confidentiality.data_disclosure | Confirmed or potential data disclosure | related-to | T1025 | Data from Removable Media |