Communication Through Removable Media (T1092)

Tactic: Command and Control · Platforms: Linux, macOS, Windows

The interactive view maps 1 detection strategy, 2 mitigations, 1 threat group, 2 software entries to this technique, alongside D3FEND countermeasures and data-component coverage.

Overview

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system. Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by Replication Through Removable Media. Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.

Explore

• Open T1092 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1092
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan