T1091 — Replication Through Removable Media

Tactics: Lateral Movement, Initial Access · Platforms: Windows

Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of…

Sigma detection rules (1)

T1091 Replication Through Removable Media

title: T1091 Replication Through Removable Media
id: dc7deee8-f1c1-4514-a439-22a63e2e5a7e
description: 'Detects creation of an autorun.inf file or an executable/script file dropped at the root of a non-system drive letter (D: through Z:). (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: DriveLetterMatch, FileExecutionWindow, ParentProcess, FileEntropy.'
references:
  - https://attack.mitre.org/techniques/T1091
author: Shahrukh Khan
date: 2026-02-19
license: MIT
tags:
  - attack.lateral-movement
  - attack.initial-access
  - attack.t1091

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection_autorun:
    TargetFilename|endswith: '\autorun.inf'
  selection_removable_root:
    TargetFilename|re: '^[D-Z]:\\[^\\]{1,64}\.(exe|scr|cmd|bat|vbs|lnk|dll)
    
  


  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (selection_autorun or selection_removable_root) and not filter_system_account

falsepositives:
  - Legitimate software installers or portable applications writing to root of a secondary/USB drive.

level: medium

Explore