T1025 Data from Removable Media
EnterpriseAdversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information. Some adversaries may also use Automated Collection on removable media.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
mitigations
ATT&CK mitigations that reduce this.
detected by (3)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.DSData Securitystrong · backed by 8 of 15 mapped controls
- PR.AAIdentity Management, Authentication, and Access Controlmoderate · backed by 4 of 15 mapped controls
- DE.CMContinuous Monitoringweak · backed by 2 of 15 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (15)
Security controls that mitigate this.
groups (4)
Threat groups associated with this.
software (20)
Malware and tools associated with this.
source
Where this definition is published.