TA0001 · INITIAL ACCESS
Replication Through Removable Media
Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes.
Detect it with
Monitor file access on removable media. Detect processes that execute from removable media after it is mounted or when initiated by a user.
Why it matters on shift
Replication Through Removable Media is one of the concrete ways adversaries achieve initial access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After initial access, the next tactic is usually Execution. Search your telemetry for the transition before closing the ticket.
Kill-chain context