Lateral Movement · Initial Access

T1091 — Replication Through Removable Media

Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system...

Investigate Replication Through Removable Media activity in the context of Lateral Movement/Initial Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

Platforms

Windows

Priority / status

low / complete

Evidence to collect

Host or resource affected
Account or identity involved
Timestamp of the activity
Related process, file, or network artifact
Any preceding or follow-on alerts

ATT&CK Technique	D3FEND Technique	Practical SOC Action	Tooling
T1091 Replication Through Removable Media	Radiation Hardening	Apply Radiation Hardening to reduce this technique's viability before an incident occurs.	Defender for Endpoint
T1091 Replication Through Removable Media	IO Port Restriction	Apply IO Port Restriction to contain the blast radius once this technique is observed.	Defender for Endpoint
T1091 Replication Through Removable Media	Hardware Component Inventory	Use Hardware Component Inventory to establish a baseline that makes this technique's deviations easier to spot.	Defender for Endpoint

T1091 Replication Through Removable Media → D3FEND → SOC action

Investigation steps — Microsoft

Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.
Check whether activity aligns with a planned change or approved business process.
Identify all affected users/devices/resources over the prior 24 hours.
Determine whether this is isolated or part of a broader campaign.
Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.
Elevate severity if privileged identities, critical systems, or repeated activity is observed.
Capture all evidence (query results, entities, timeline) in the incident record.
Route to the appropriate response playbook and customer escalation path.

Investigation steps — generic

Confirm whether the observed replication through removable media activity matches expected administrative or application behaviour.
Identify the host, account, or resource where the activity occurred and its business criticality.
Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.
Real detection reference: "Execution from a Removable Media with Network Connection" -- Identifies process execution from a removable media and by an unusual process. Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes.

Response actions

Action	Risk	Automation safe	Approval required
Contain impacted identities/endpoints/sessions based on obse	Low	No	Yes
Block malicious indicators (IP, URL, domain, hash) where ava	Medium	No	Yes
Complete blast radius analysis across related logs and entit	Low	No	Yes
Notify stakeholders according to incident priority and custo	Low	Yes	No
Remove persistence or unauthorized access paths identified d	Low	No	Yes
Capture lessons learned and update rule tuning/watchlists.	Low	No	Yes

KQL

Starting point for T1091

DeviceEvents
| where TimeGenerated > ago(24h)
| where ActionType has "<tune to T1091>"

Escalation criteria

Replication Through Removable Media activity observed on a privileged account or critical system.
Activity follows or precedes other suspicious behaviour in the same investigation.
Automated triage cannot confidently rule out malicious intent.

False positive considerations

Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners
Security testing or red-team exercise — Source identity/host matches approved test plan

View Markdown Download Markdown

# T1091 - Replication Through Removable Media

## SOC Recommendation
Investigate Replication Through Removable Media activity in the context of Lateral Movement/Initial Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Radiation Hardening | Harden | Apply Radiation Hardening to reduce this technique's viability before an incident occurs. |
| IO Port Restriction | Isolate | Apply IO Port Restriction to contain the blast radius once this technique is observed. |
| Hardware Component Inventory | Model | Use Hardware Component Inventory to establish a baseline that makes this technique's deviations easier to spot. |

## Investigation Steps
1. Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.
2. Check whether activity aligns with a planned change or approved business process.
3. Identify all affected users/devices/resources over the prior 24 hours.
4. Determine whether this is isolated or part of a broader campaign.
5. Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.
6. Elevate severity if privileged identities, critical systems, or repeated activity is observed.
7. Capture all evidence (query results, entities, timeline) in the incident record.
8. Route to the appropriate response playbook and customer escalation path.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain impacted identities/endpoints/sessions based on obse | Low | No | Yes |
| Block malicious indicators (IP, URL, domain, hash) where ava | Medium | No | Yes |
| Complete blast radius analysis across related logs and entit | Low | No | Yes |
| Notify stakeholders according to incident priority and custo | Low | Yes | No |
| Remove persistence or unauthorized access paths identified d | Low | No | Yes |
| Capture lessons learned and update rule tuning/watchlists. | Low | No | Yes |

## KQL
```kql
DeviceEvents
| where TimeGenerated > ago(24h)
| where ActionType has "<tune to T1091>"
```

## Escalation Criteria
- Replication Through Removable Media activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners
- Security testing or red-team exercise — Source identity/host matches approved test plan

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1091.json

Response:

{
  "technique_id": "T1091",
  "name": "Replication Through Removable Media",
  "priority": "low",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Lateral Movement",
    "Initial Access"
  ],
  "platforms": [
    "Windows"
  ],
  "summary": "Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system...",
  "soc_recommendation": "Investigate Replication Through Removable Media activity in the context of Lateral Movement/Initial Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-RH",
      "name": "Radiation Hardening",
      "relationship": "harden",
      "practical_action": "Apply Radiation Hardening to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-IOPR",
      "name": "IO Port Restriction",
      "relationship": "isolate",
      "practical_action": "Apply IO Port Restriction to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-HCI",
      "name": "Hardware Component Inventory",
      "relationship": "model",
      "practical_action": "Use Hardware Component Inventory to establish a baseline that makes this technique's deviations easier to spot.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.",
      "Check whether activity aligns with a planned change or approved business process.",
      "Identify all affected users/devices/resources over the prior 24 hours.",
      "Determine whether this is isolated or part of a broader campaign.",
      "Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.",
      "Elevate severity if privileged identities, critical systems, or repeated activity is observed.",
      "Capture all evidence (query results, entities, timeline) in the incident record.",
      "Route to the appropriate response playbook and customer escalation path."
    ],
    "generic": [
      "Confirm whether the observed replication through removable media activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Execution from a Removable Media with Network Connection\" -- Identifies process execution from a removable media and by an unusual process. Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain impacted identities/endpoints/sessions based on obse",
      "category": "Containment",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Contain impacted identities/endpoints/sessions based on observed behavior."
    },
    {
      "name": "Block malicious indicators (IP, URL, domain, hash) where ava",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Block malicious indicators (IP, URL, domain, hash) where available."
    },
    {
      "name": "Complete blast radius analysis across related logs and entit",
      "category": "Eradication",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Complete blast radius analysis across related logs and entities."
    },
    {
      "name": "Notify stakeholders according to incident priority and custo",
      "category": "Eradication",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide",
      "notes": "Notify stakeholders according to incident priority and customer SLA."
    },
    {
      "name": "Remove persistence or unauthorized access paths identified d",
      "category": "Recovery",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Remove persistence or unauthorized access paths identified during investigation."
    },
    {
      "name": "Capture lessons learned and update rule tuning/watchlists.",
      "category": "Recovery",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "Starting point for T1091",
        "description": "Generic starting query -- tune to the specific data source relevant to this technique.",
        "query": "DeviceEvents\n| where TimeGenerated > ago(24h)\n| where ActionType has \"<tune to T1091>\""
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "1542fa53-955e-4330-8e4d-b2d812adeb5f — Execution from a Removable Media with Network Connection",
        "description": "(EQL) Identifies process execution from a removable media and by an unusual process. Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "sequence by process.entity_id with maxspan=5m\n [process where host.os.type == \"windows\" and event.action == \"start\" and\n\n  /* Direct Exec from USB */\n  (process.Ext.device.bus_type : \"usb\" or process.Ext.device.product_id : \"USB *\") and\n  (process.code_signature.trusted == false or process.code_signature.exists == false) and\n\n  not process.code_signature.status : (\"errorExpired\", \"errorCode_endpoint*\")]\n [network where host.os.type == \"windows\" and event.action == \"connection_attempted\"]"
      },
      {
        "name": "483832a8-ffdd-4e11-8e96-e0224f7bda9b — New USB Storage Device Mounted",
        "description": "(KUERY) Identifies newly seen removable devices by device.serial_number and host.id using the Elastic Defend device mount events. While this activity is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "host.os.type:(macos or windows) and event.type:device and event.action:mount and event.outcome:success and volume.removable:true"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Replication Through Removable Media activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners",
    "Security testing or red-team exercise — Source identity/host matches approved test plan"
  ],
  "confluence": {
    "title": "T1091 - Replication Through Removable Media Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}