T1025 — Data from Removable Media

Tactic: Collection · Platforms: Linux, macOS, Windows

Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may…

Sigma detection rules (3)

T1025 Data from Removable Media

title: T1025 Data from Removable Media
id: 717439e9-917a-426a-9fc5-e46c7d295a34
description: 'Detection of Data Access and Collection from Removable Media. (Retargeted from the original process_creation label to file_event - this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: VolumeLabel, TimeWindow, TargetFileType.'
references:
  - https://attack.mitre.org/techniques/T1025
author: Shahrukh Khan
date: 2026-03-02
license: MIT
tags:
  - attack.collection
  - attack.t1025

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    TargetFilename|re: '^[D-Z]:\\.*'

  selection_collection_tool:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\explorer.exe'
      - '\robocopy.exe'
      - '\xcopy.exe'

  selection_sensitive_ext:
    TargetFilename|endswith:
      - '.doc'
      - '.docx'
      - '.xls'
      - '.xlsx'
      - '.pdf'
      - '.zip'
      - '.rar'
      - '.7z'
      - '.pst'
      - '.csv'

  filter_common:
    TargetFilename|contains:
      - '\Windows\'
      - '\Program Files'

  condition: selection and selection_collection_tool and selection_sensitive_ext and not filter_common

falsepositives:
  - Still broad - Sysmon FileCreate cannot directly distinguish a genuinely removable USB drive from any other non-C: volume (secondary internal disks, mapped network drives); recommend correlating with actual USB/removable-device enumeration (Sysmon EventID 1 + WMI Win32_DiskDrive/Win32_Volume DriveType) for high-confidence attribution. Legitimate document-management or backup workflows saving Office/PDF/archive files to secondary drives will also match.

level: informational

T1025 Data from Removable Media

title: T1025 Data from Removable Media
id: e2a545ba-f793-47df-b326-ca2d94fd1e9a
description: 'Detection of Data Access and Collection from Removable Media. /mnt/ is routinely used for non-removable mounts (NFS shares, extra disks, container bind mounts), so including it in the path prefix list made this indistinguishable from routine non-removable-media access; dropped /mnt/ and kept only the removable-media-specific mount conventions (/media/, /run/media/). Also required a paired read-oriented SYSCALL (open/openat, success) rather than a bare path reference. (Retargeted to the file_event auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MountPathRegex, AccessMask.'
references:
  - https://attack.mitre.org/techniques/T1025
author: Shahrukh Khan
date: 2026-05-31
license: MIT
tags:
  - attack.collection
  - attack.t1025

logsource:
  category: file_event
  product: linux

detection:
  selection_path:
    type: PATH
    name|startswith:
      - '/media/'
      - '/run/media/'
  selection_read:
    type: SYSCALL
    syscall:
      - open
      - openat
    success: 'yes'

  condition: selection_path and selection_read

falsepositives:
  - Normal user interaction with mounted USB drives/removable media is common on workstations and does not alone indicate data collection intent; this remains a coarse proxy since auditd cannot distinguish a single expected file open from a bulk collection sweep.

level: low

T1025 Data from Removable Media

title: T1025 Data from Removable Media
id: 85501d77-d67e-4b70-aedf-73984cc2f6da
description: 'Detection of Data Access and Collection from Removable Media. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: VolumePath, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1025
author: Shahrukh Khan
date: 2026-03-07
license: MIT
tags:
  - attack.collection
  - attack.t1025

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/diskutil'
      - '/hdiutil'
  selection_args:
    CommandLine|contains:
      - 'mount'
      - '/Volumes/'
  condition: selection and selection_args

falsepositives:
  - Ordinary mounting of external drives or disk images by users, since mount events alone do not confirm that data was subsequently collected from the volume.

level: low

Explore