Data from Removable Media

From enterprise
Jump to: navigation, search
Data from Removable Media
ID T1025
Tactic Collection
Platform Linux, macOS, Windows
System Requirements Privileges to access removable media drive and files
Data Sources File monitoring, Process monitoring, Process command-line parameters

Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration.

Adversaries may search connected removable media on computers they have compromised to find files of interest. Interactive command shells may be in use, and common functionality within cmd may be used to gather information. Some adversaries may also use Automated Collection on removable media.


  • An APT28 backdoor may collect the entire contents of an inserted USB device.1
  • A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.2
  • CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list.3
  • Crimson contains a module to collect data from removable drives.4
  • FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by SPACESHIP.5
  • Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.6
  • Remsec has a package that collects documents from any inserted USB sticks.7
  • Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.8
  • Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim.910


Identify unnecessary system utilities or potentially malicious software that may be used to collect data from removable media, and audit and/or block them by using whitelisting11 tools, like AppLocker,1213 or Software Restriction Policies14 where appropriate.15


Monitor processes and command-line arguments for actions that could be taken to collect files from a system's connected removable media. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.