// MITRE ATT&CK
T1091 · Replication Through Removable Media
🎯 Lateral Movement Windows
Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of exec...
How to detect & mitigate it
Detecting Replication Through Removable Media starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1021.005
VNC T1080
Taint Shared Content T1021.004
SSH T1021.008
Direct Cloud VM Connections T1563.001
SSH Hijacking T1021.002
SMB/Windows Admin Shares T1550
Use Alternate Authentication Material T1021
Remote Services
VNC T1080
Taint Shared Content T1021.004
SSH T1021.008
Direct Cloud VM Connections T1563.001
SSH Hijacking T1021.002
SMB/Windows Admin Shares T1550
Use Alternate Authentication Material T1021
Remote Services
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.