Communication Through Removable Media is the transfer of data or commands using portable storage such as USB drives or external disks. Attackers use it to bypass network monitoring and move malware or stolen data between systems, including air-gapped environments. Defenders should control device use, scan media, and monitor for unusual mount and copy activity.
What Communication Through Removable Media Means
Communication through removable media is a covert or semi-covert transfer path that uses portable storage to move data, instructions, or malware between systems. It matters because it can operate outside normal network controls and reach isolated or tightly monitored environments.
This technique is often associated with USB drives, external disks, and similar devices that can be carried between endpoints. The security concern is not the medium itself, but the trust granted to whatever is copied onto it and then introduced into another host.
Why It Is Dangerous
Removable media can bypass perimeter inspection, web filtering, and email controls, which makes it attractive for both exfiltration and initial compromise. It is especially risky when an organisation assumes that absence from the network also means absence from exposure.
Because portable media crosses administrative and sometimes physical boundaries, it can serve as a bridge between systems with different trust levels. That makes it useful for planting payloads, transferring stolen files, or staging commands that would be easier to detect on a network channel.
How Defenders Reduce Exposure
Exposure starts with knowing where removable media is allowed, where it is blocked, and which endpoints can mount it. A strong inventory of devices, coupled with policy enforcement and endpoint logging, helps reveal where uncontrolled transfer paths still exist.
Defenders should also focus on content inspection and device hygiene. Scanning media before opening files, restricting autorun-like behavior, and limiting write access reduce the chance that a portable device becomes an infection vector or a data-smuggling tool.
For data leaving the environment, the relevant question is often whether media use is the only practical egress path. If so, monitoring for unusual copy volume, repeated mounts, and transfers involving sensitive folders becomes an important part of data exfiltration defense.
Detection, Response, and After-Use Review
Detection should look for more than file copies. Sudden device insertion on restricted hosts, repeated mount and unmount activity, archive creation, and file movement shortly before logoff can all indicate that a removable medium is being used as a covert channel.
When removable media is linked to compromise, response needs to cover both the endpoint and the device path. Organisations should review whether malware execution, staging, or data theft occurred, then check for lateral movement, persistence, or additional hosts that may have been touched through the same media.
Sanitisation also matters after use, especially for devices that may contain regulated or sensitive data. NIST’s NIST SP 800-88 Media Sanitization guidance is useful when media must be cleared, purged, or destroyed before reuse or disposal.
Because this technique is a recognised adversary pattern, mapping suspicious activity to command and control tradecraft can help analysts distinguish routine device use from purposeful covert communication.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1091 — Replication Through Removable Media | Defines removable-media transfer as an adversary technique for spreading or moving data. |
| Recommendation — Detect removable-media execution paths and block unauthorized device use on sensitive hosts. | ||
| NIST SP 800-53 Rev 5 | MP-7 — Media Use | Directly governs restrictions and handling of removable media. |
| CM-8 — System Component Inventory | Helps identify which systems can mount or interact with portable media. | |
| SI-3 — Malicious Code Protection | Supports scanning and inspection of files introduced via portable media. | |
| Recommendation — Enforce media-use restrictions and approved-device controls across endpoints. Maintain an inventory of endpoints and peripheral paths that can accept removable media. Scan removable media and transferred files for malicious content before execution. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | Covers protection against malware introduced through portable storage. |
| Recommendation — Harden endpoint malware defenses against payloads introduced from removable media. | ||