{ "technique_id": "T1091", "name": "Replication Through Removable Media", "priority": "low", "status": "complete", "version": "0.1.0", "last_reviewed": "2026-07-23", "generated_by": "SOC Response Atlas by Basyrix", "tactics": [ "Lateral Movement", "Initial Access" ], "platforms": [ "Windows" ], "summary": "Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system...", "soc_recommendation": "Investigate Replication Through Removable Media activity in the context of Lateral Movement/Initial Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.", "d3fend_mappings": [ { "id": "D3-RH", "name": "Radiation Hardening", "relationship": "harden", "practical_action": "Apply Radiation Hardening to reduce this technique's viability before an incident occurs.", "tooling": [ "Defender for Endpoint" ] }, { "id": "D3-IOPR", "name": "IO Port Restriction", "relationship": "isolate", "practical_action": "Apply IO Port Restriction to contain the blast radius once this technique is observed.", "tooling": [ "Defender for Endpoint" ] }, { "id": "D3-HCI", "name": "Hardware Component Inventory", "relationship": "model", "practical_action": "Use Hardware Component Inventory to establish a baseline that makes this technique's deviations easier to spot.", "tooling": [ "Defender for Endpoint" ] } ], "investigation_steps": { "microsoft": [ "Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.", "Check whether activity aligns with a planned change or approved business process.", "Identify all affected users/devices/resources over the prior 24 hours.", "Determine whether this is isolated or part of a broader campaign.", "Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.", "Elevate severity if privileged identities, critical systems, or repeated activity is observed.", "Capture all evidence (query results, entities, timeline) in the incident record.", "Route to the appropriate response playbook and customer escalation path." ], "generic": [ "Confirm whether the observed replication through removable media activity matches expected administrative or application behaviour.", "Identify the host, account, or resource where the activity occurred and its business criticality.", "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.", "Real detection reference: \"Execution from a Removable Media with Network Connection\" -- Identifies process execution from a removable media and by an unusual process. Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes." ] }, "evidence_to_collect": [ "Host or resource affected", "Account or identity involved", "Timestamp of the activity", "Related process, file, or network artifact", "Any preceding or follow-on alerts" ], "response_actions": [ { "name": "Contain impacted identities/endpoints/sessions based on obse", "category": "Containment", "risk": "Low", "automation_safe": false, "approval_required": true, "tool": "See investigation guide", "notes": "Contain impacted identities/endpoints/sessions based on observed behavior." }, { "name": "Block malicious indicators (IP, URL, domain, hash) where ava", "category": "Containment", "risk": "Medium", "automation_safe": false, "approval_required": true, "tool": "See investigation guide", "notes": "Block malicious indicators (IP, URL, domain, hash) where available." }, { "name": "Complete blast radius analysis across related logs and entit", "category": "Eradication", "risk": "Low", "automation_safe": false, "approval_required": true, "tool": "See investigation guide", "notes": "Complete blast radius analysis across related logs and entities." }, { "name": "Notify stakeholders according to incident priority and custo", "category": "Eradication", "risk": "Low", "automation_safe": true, "approval_required": false, "tool": "See investigation guide", "notes": "Notify stakeholders according to incident priority and customer SLA." }, { "name": "Remove persistence or unauthorized access paths identified d", "category": "Recovery", "risk": "Low", "automation_safe": false, "approval_required": true, "tool": "See investigation guide", "notes": "Remove persistence or unauthorized access paths identified during investigation." }, { "name": "Capture lessons learned and update rule tuning/watchlists.", "category": "Recovery", "risk": "Low", "automation_safe": false, "approval_required": true, "tool": "See investigation guide" } ], "queries": { "kql": [ { "name": "Starting point for T1091", "description": "Generic starting query -- tune to the specific data source relevant to this technique.", "query": "DeviceEvents\n| where TimeGenerated > ago(24h)\n| where ActionType has \"\"" } ], "spl": [], "esql": [ { "name": "1542fa53-955e-4330-8e4d-b2d812adeb5f — Execution from a Removable Media with Network Connection", "description": "(EQL) Identifies process execution from a removable media and by an unusual process. Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. (Source: Elastic's official detection-rules repository (Elastic License v2).)", "query": "sequence by process.entity_id with maxspan=5m\n [process where host.os.type == \"windows\" and event.action == \"start\" and\n\n /* Direct Exec from USB */\n (process.Ext.device.bus_type : \"usb\" or process.Ext.device.product_id : \"USB *\") and\n (process.code_signature.trusted == false or process.code_signature.exists == false) and\n\n not process.code_signature.status : (\"errorExpired\", \"errorCode_endpoint*\")]\n [network where host.os.type == \"windows\" and event.action == \"connection_attempted\"]" }, { "name": "483832a8-ffdd-4e11-8e96-e0224f7bda9b — New USB Storage Device Mounted", "description": "(KUERY) Identifies newly seen removable devices by device.serial_number and host.id using the Elastic Defend device mount events. While this activity is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices. (Source: Elastic's official detection-rules repository (Elastic License v2).)", "query": "host.os.type:(macos or windows) and event.type:device and event.action:mount and event.outcome:success and volume.removable:true" } ] }, "automation": { "safe": [ "Add recommendation as Sentinel incident comment.", "Run enrichment queries.", "Create ServiceNow SecOps task." ], "approval_required": [ "Contain or disable the affected host/account.", "Any change to production configuration." ] }, "escalation_criteria": [ "Replication Through Removable Media activity observed on a privileged account or critical system.", "Activity follows or precedes other suspicious behaviour in the same investigation.", "Automated triage cannot confidently rule out malicious intent." ], "false_positive_considerations": [ "Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners", "Security testing or red-team exercise — Source identity/host matches approved test plan" ], "confluence": { "title": "T1091 - Replication Through Removable Media Response Guidance", "labels": [ "mitre", "attack", "d3fend", "secops", "basyrix" ], "sections": [ "summary", "d3fend_mappings", "investigation_steps", "response_actions", "queries", "automation", "escalation_criteria", "false_positive_considerations" ] } }