Detecting and Mitigating Replication Through Removable Media (T1091)

Air gaps and disconnected networks feel safe because nothing reaches them over the wire. MITRE ATT&CK Replication Through Removable Media (T1091) is the technique that proves a USB drive can cross the gap. It is listed under lateral movement and initial access, and MITRE names Windows as the platform.

How attackers use it

MITRE says adversaries may move onto systems, possibly on disconnected or air-gapped networks, by copying malware to removable media and relying on Autorun features to run it when the media is inserted. MITRE separates two cases:

• Lateral movement. Executable files stored on removable media are modified, or malware is copied and renamed to look like a legitimate file so that a user on another system runs it.
• Initial access. The media is manipulated by hand, the systems used to format the media are modified, or the media's firmware is modified.

Mobile devices count too. MITRE notes that phones may infect PCs when connected by USB, using devices such as Android and iOS handsets and, in some instances, USB charging cables. A phone connected to a system may appear mounted like a USB drive. If compatible malware is on the phone, the machine may be infected, especially with Autorun enabled.

How to detect it

MITRE's strategy (DET0301) describes an execution chain: files executing from removable media after a drive mount, correlated with file write activity, Autorun use, or lateral spread through staged tools.

What this asks of defenders in practice:

• Log device and volume mount events so you know when removable media appeared and on which host.
• Log process creation with the path of the executable. Anything running from a removable drive letter is worth review.
• Correlate the two. A mount followed within minutes by an executable launching from that volume is the pattern MITRE describes.
• Look for the same file name appearing on several hosts shortly after a drive moved between them.

For air-gapped systems, local logging and a regular process to collect it matter more, since there is no network to stream it over.

How to reduce the risk

MITRE lists three mitigations:

1. On Windows 10, enable Attack Surface Reduction rules to block unsigned or untrusted executable files, such as .exe, .dll or .scr, from running from USB removable drives (Behavior Prevention on Endpoint).
2. Disable Autorun if it is unnecessary, and disallow or restrict removable media at organizational policy level if the business does not need it (Disable or Remove Feature or Program).
3. Limit the use of USB devices and removable media within the network (Limit Hardware Installation).

For sites that must move files into disconnected zones, a common pattern is a controlled transfer station that scans media, rather than direct use of staff drives. That is practical advice rather than a MITRE listing, but it fits the second mitigation.

Check your own environment

• Is Autorun disabled by policy on every Windows endpoint, including isolated ones?
• Which groups really need removable media? Can the rest be blocked?
• Are ASR rules for USB execution enabled and in block mode?
• Can you answer, for any host, which drives were mounted last week?

A read-only check of the Autorun policy value on Windows, where 255 (0xFF) means all drive types are disabled:

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDriveTypeAutoRun

If the value is missing, the policy has not been set at that path.

Quick check

Sources

• MITRE ATT&CK, T1091 Replication Through Removable Media: https://attack.mitre.org/techniques/T1091/