People forget how much sits on removable media. Backup drives, USB sticks and optical discs often hold the files that never made it to a managed server. An attacker who already controls the computer gets a look at all of it the moment the drive is plugged in.
MITRE tracks this as Data from Removable Media, technique T1025, in the Collection tactic. It applies to Linux, macOS and Windows.
How attackers use it
MITRE describes the adversary searching connected removable media on a compromised computer to find files of interest. Optical drives, USB memory and similar devices all count. The data is gathered before Exfiltration. The adversary may work from an interactive command shell, using built-in functionality in cmd to gather information, or may use Automated Collection to sweep the media.
Note what this is not. It is not about malware spreading by USB. It is about reading data off a device that a user connected for legitimate reasons.
How to detect it
MITRE's strategy (DET0511) has one analytic per operating system:
- Windows. A USB device is mounted, then files are enumerated, copied or compressed using scripting engines, cmd or remote access tools.
- Linux. An external drive is mounted under /media or /mnt, then targeted data is accessed or copied through the shell with commands such as cp or tar.
- macOS. A USB drive is attached and sensitive files are accessed using Finder, cp or bash scripts.
The pattern is a mount event followed by bulk reads or archive creation. A user who copies one document off a stick is routine. A script that walks the whole drive, or a process that has never touched removable storage doing so, is not.
How to reduce the risk
MITRE lists one mitigation: data loss prevention. DLP can restrict access to sensitive data and detect sensitive data that is stored unencrypted.
In plain terms:
- Know which classes of data are allowed on removable media at all, and block the rest by policy.
- Require encryption for any device that is allowed to hold sensitive files.
- Alert when sensitive data is copied to a removable device.
Check your own environment
# Linux: list block devices and where they are mounted
lsblk -o NAME,TRAN,MOUNTPOINT
# Linux: show anything mounted under the usual removable paths
findmnt | grep -E '/media|/mnt'
# Windows: list disks and flag those on the USB bus
Get-Disk | Select-Object Number, FriendlyName, BusType, Size
Also ask whether your endpoint tools record device mount events, and whether your DLP rules cover removable media or only email and web.
Quick check
What event pattern marks this technique in MITRE's strategy?
A removable device is mounted, followed by enumeration, copying or compression of its files.
Sources
- MITRE ATT&CK, Data from Removable Media (T1025)
