T1092 — Communication Through Removable Media

Tactic: Command and Control · Platforms: Linux, macOS, Windows

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system. Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and…

Sigma detection rules (3)

T1092 Communication Through Removable Media

title: T1092 Communication Through Removable Media
id: f8d3c745-e3eb-4d3b-abca-b70e9dca2b03
description: 'Detects file-creation events writing command/script-like files to non-system (likely removable) drive letters, a proxy for staging data used to relay commands between air-gapped hosts via removable media. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: RemovableDriveLetter, WriteToReadTimeWindow, FileNamePattern. Note: cross-host relay cannot be confirmed from a single hosts file-creation telemetry alone -- correlate matching filenames/hashes across source and destination hosts.'
references:
  - https://attack.mitre.org/techniques/T1092
author: Shahrukh Khan
date: 2026-03-19
license: MIT
tags:
  - attack.command-and-control
  - attack.t1092

logsource:
  product: windows
  category: file_event
  service: sysmon

detection:
  selection_drive:
    TargetFilename|startswith:
      - 'D:\'
      - 'E:\'
      - 'F:\'
      - 'G:\'
      - 'H:\'
  selection_ext:
    TargetFilename|endswith:
      - '.txt'
      - '.dat'
      - '.log'
      - '.cmd'
      - '.bat'
      - '.ps1'
      - '.vbs'
      - '.ini'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection_drive and selection_ext and not filter_system_account

falsepositives:
  - Legitimate file copies, backups, or data exports to USB/removable drives will also match; this rule cannot by itself distinguish air-gapped C2 relay traffic from normal removable-media use.
  - Only drive letters D-H are covered; environments that assign removable media to other letters need the list extended.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1092 Communication Through Removable Media

title: T1092 Communication Through Removable Media
id: e7524377-5f91-4edb-975d-2989889a6032
description: 'Cross-host C2 via Removable Media Relay. This technique fundamentally requires correlating the appearance of the same relay artifact across two physically-disconnected hosts, which single-host auditd file_event telemetry cannot establish on its own. Narrowed from "any file creation under a removable-media mount" (indistinguishable from ordinary USB transfers) to the closest single-host proxy: hidden/staging-style filenames written at a removable-media mount root. Tune using: MountPathPattern, TimeWindowBetweenHosts.'
references:
  - https://attack.mitre.org/techniques/T1092
author: Shahrukh Khan
date: 2026-02-08
license: MIT
tags:
  - attack.command-and-control
  - attack.t1092

logsource:
  category: file_event
  product: linux

detection:
  selection_staging_file:
    type: PATH
    nametype: CREATE
    name|re: '(/media/|/mnt/usb|/run/media/).*/\.[^/]+
    
  



  condition: selection_staging_file

falsepositives:
  - Desktop environments and file managers routinely create hidden metadata/cache files (e.g. .Trash-1000, .Spotlight-V100, .fseventsd) on removable media as soon as it is mounted; true confirmation still requires correlating the same artifact appearing on a second, disconnected host, which auditd alone cannot provide.

level: low

T1092 Communication Through Removable Media

title: T1092 Communication Through Removable Media
id: f6a2de11-e713-4ca1-b21e-e6cb23443711
description: 'Cross-host C2 via Removable Media Relay. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: VolumeNameFilter, ProcessContext.'
references:
  - https://attack.mitre.org/techniques/T1092
author: Shahrukh Khan
date: 2026-06-26
license: MIT
tags:
  - attack.command-and-control
  - attack.t1092

logsource:
  category: file_event
  product: macos

detection:
  selection:
    TargetFilename|startswith: '/Volumes/'
    TargetFilename|contains:
      - '.stage'
      - 'autorun'

  condition: selection

falsepositives:
  - Legitimate use of USB drives for file transfer creates similarly located files without malicious intent.

level: medium

Explore