Communication Through Removable Media (T1092) is a command and control technique for networks that have no direct internet link. It applies to Linux, macOS and Windows.
How attackers use it
MITRE says adversaries can control compromised hosts on potentially disconnected networks by using removable media to carry commands from system to system. Both systems must be compromised. The likely order is that an internet connected system falls first, and the second falls through lateral movement by replication through removable media (T1091). Commands and files are then relayed from the disconnected system to the internet connected system that the adversary can reach directly.
The drive acts as the network cable.
How to detect it
MITRE's strategy (DET0090) looks for a sequence across two hosts:
- Windows: removable media mounted, files written or updated, then read or executed on a separate host.
- Linux: file writes to USB mount directories such as /media/ and /run/media/, followed by access to or execution of the same file on another host.
- macOS: removable volume mounts, matched to file input and output on the volume, followed by execution of the same file shortly after insertion.
This is a cross host correlation, so it needs logs from both sides in one place. For truly disconnected hosts, collect logs on a schedule through a controlled path.
How to reduce the risk
MITRE lists two mitigations. Disable Autoruns if unnecessary, and disallow or restrict removable media at organizational policy level if the business does not need it. Where drives must be used, track them: know which hosts mount them and who owns them.
Quick check
Why does this technique need two compromised systems?
One host must be reachable by the adversary over the internet, and the other, disconnected, receives commands through the drive. The drive carries data between them.
Sources
- MITRE ATT&CK, T1092 Communication Through Removable Media: https://attack.mitre.org/techniques/T1092/
