T1025 · Data from Removable Media

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1025 · Data from Removable Media · Sunturai

attack-patternenterprise-attackT1025

Data from Removable Media

attack-pattern--1b7ba276-eedc-4951-a762-0ceea2c030ec

Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information. Some adversaries may also use Automated Collection on removable media.

Created: May 31, 2017, 9:30 PM UTC
Modified: Oct 24, 2025, 5:48 PM UTC

4 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Removable Storage ONLINE	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Windows WPDBusEnum Registry Key Modification	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows USBSTOR Registry Key Modification	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Process Executed From Removable Media	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0

Showing 4 of 4

Filter in the catalogue

External references

mitre-attackT1025Open reference

Platforms

LinuxmacOSWindows

Kill chain phases

collection

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object