Most USB controls are built to stop people copying data out, but T1025 is the reverse: malware already on a host quietly reads whatever is on the drives that users plug in, including media that has come from networks the attacker cannot reach. MITRE ATT&CK tracks this as T1025 Data from Removable Media, a Collection (TA0009) technique on Linux, macOS and Windows. Optical discs, USB memory and other removable media are all in scope. This guide is for detection engineers, endpoint owners and teams running segregated or air-gapped networks. It covers the technique view: ATT&CK v20 procedures, detection analytics, the mapped mitigation and testing. Device policy design, encrypted drives and USB allowlisting are covered in the Removable Media and USB Control Guide, which this page does not repeat.
Key takeaways
- The threat is the host, not the user. T1025 malware waits for media to be mounted and harvests files by extension or keyword. The user who inserted the drive does nothing wrong.
- Removable media bridges air gaps. ATT&CK procedures such as USBStealer and TajMahal collect data that was carried across from another system on the same drive.
- Windows can audit every read without SACLs. Microsoft states Audit Removable Storage generates events for all objects and all access types, with no dependency on the object's SACL.
- Read restrictions are the preventive control. Most programmes block writes to USB; T1025 is stopped by limiting reads on hosts that do not need media, and by DLP, the only ATT&CK v20 mitigation mapped.
- Espionage tooling dominates. The v20 procedure list is mostly espionage malware (Turla, APT28, Gamaredon, Patchwork, Transparent Tribe tooling), so sensitive government, defence and industrial environments carry the most risk.
What the technique covers
ATT&CK v20 (technique version 1.3, last modified 24 October 2025) describes adversaries searching connected removable media on compromised computers to find files of interest, collecting sensitive data from any removable media (optical disk drive, USB memory and so on) prior to exfiltration. Interactive shells and cmd may be used, and some adversaries use T1119 Automated Collection on removable media. T1025 has no sub-techniques.
It sits in a chain of related techniques, each with its own ATT&CK entry:
| Technique | Role in the chain | Direction of data |
|---|---|---|
| T1120 Peripheral Device Discovery | Learn which devices and drives are attached | None |
| T1025 Data from Removable Media | Read and gather files from mounted media | Media to compromised host |
| T1091 Replication Through Removable Media | Copy malware onto media to infect other systems | Host to media |
| T1052.001 Exfiltration over USB | Move data out on a physical device | Host to media |
| T1560 and T1074 | Pack and stage what was gathered | Within host |
How adversaries use it: real cases
Procedure examples from the ATT&CK v20 data, with the source ATT&CK cites:
- USBStealer (S0136): once a removable device is inserted back into the first victim, it collects data from the drive that was exfiltrated from a second victim (ESET, 2014; Kaspersky). This is the air-gap pattern: the drive is the courier.
- TajMahal (S0467): steals written CD images and files of interest from previously connected removable drives when they become available again (Kaspersky, April 2019).
- Ramsay (S0458): collects data from removable media and stages it for exfiltration (ESET, May 2020), a framework built for air-gapped networks.
- Rover (S0090): searches attached removable drives for a predefined list of file extensions every five seconds (Palo Alto Networks).
- Gamaredon Group (G0047): a file stealer steals data from newly connected logical volumes, including USB drives (Palo Alto Networks; ESET 2020 and 2024).
- APT28 (G0007): a backdoor may collect the entire contents of an inserted USB device (Microsoft Security Intelligence Report vol. 19).
- Turla (G0010): RPC backdoors can collect files from USB thumb drives (ESET, Symantec, 2019).
- OilRig (G0049): used Wireshark's usbcapcmd utility to capture USB traffic (Symantec, October 2023).
- CosmicDuke (S0050) and Crutch (S0538): steal files from removable media matching extension and keyword lists (F-Secure; ESET, December 2020).
The common design is a watcher that triggers on mount, filters by extension (documents, CAD files, images) and copies matches to a hidden local folder for later exfiltration.
What to detect and where
ATT&CK v20 detection strategy DET0511, Detection of Data Access and Collection from Removable Media, has three analytics. Each links the mount event to file access and the process doing it.
| Platform | Analytic (ATT&CK) | Data components and log sources (from ATT&CK) | Practical rule |
|---|---|---|---|
| Windows | AN1410: USB mounted, then files enumerated, copied or compressed by scripting engines, cmd or remote access tools | File Access (Security 4663, 4670, 4656); Drive Creation (System 2003); Process Creation (Sysmon 1) | Within minutes of a mount, a process other than Explorer or an approved app reads many files on the removable volume |
| Linux | AN1411: external drive mounted to /media or /mnt, then data accessed or copied with shell, cp or tar | File Access (auditd open, read, mount); Drive Creation (journald udisks2 or udevd); Process Creation (auditd execve) | Mount followed by recursive reads or archive creation by a non-interactive process |
| macOS | AN1412: USB drive attached, sensitive files accessed via Finder, cp or scripts | Drive Creation (unified log, USBMSC messages); File Access (fs_usage reads under /Volumes/); Process Creation (osquery process_events) | Reads under /Volumes/ by interpreters or unsigned binaries |
Telemetry worth enabling
- Windows Audit Removable Storage: generates 4656, 4658 and 4663 for reads and writes on removable drives without needing SACLs. Microsoft documents Success and Failure as the recommended setting for workstations and servers. Volume is driven by how much media is used, so it is practical on hosts where media is rare.
- Defender for Endpoint device control: policies with an audit entry generate a
RemovableStoragePolicyTriggeredevent in advanced hunting, with fields includingRemovableStorageAccess,RemovableStoragePolicyVerdict,SerialNumberId,VendorIdandProductId. Device installation restrictions addPnPDeviceBlockedandPnPDeviceAllowed. - Linux: udisks2 and udev logs for mounts plus auditd rules on the mount points.
Sequences worth alerting on
- Mount then sweep: a background process opens dozens of files on a new volume within seconds of the mount.
- Copy to hidden staging: files from the removable volume written to a hidden or temp directory on the local disk.
- Repeated polling: a process that checks for new volumes on a short loop (Rover polled every five seconds).
- Media in segregated zones: any read on a host in a high-security enclave by a process outside the approved transfer tool.
Mitigations
ATT&CK v20 maps one mitigation to T1025: M1057 Data Loss Prevention. The other rows are NHI Mgmt Group recommendations.
| Control | Source | Effect on T1025 |
|---|---|---|
| Data loss prevention | ATT&CK M1057 | Restricts access to sensitive data and detects it unencrypted; see the Endpoint DLP Guide |
| Deny read on hosts that do not need media | NHI Mgmt Group recommendation | Defender device control supports read, write and execute access types; servers and kiosks rarely need any |
| Device allowlisting | NHI Mgmt Group recommendation | Only approved, managed drives mount. See M1034 Limit Hardware Installation; on Linux, USBGuard enforces allow and block policy using the kernel's USB device authorisation feature |
| Dedicated transfer stations | NHI Mgmt Group recommendation | For air-gapped networks, media enters only through a scanning station, never directly into enclave hosts; consider one-way transfer, see the Data Diodes and Unidirectional Gateways Guide |
| Encrypted, managed drives | NHI Mgmt Group recommendation | Protects lost media; once unlocked on a compromised host, files are readable, so this is not a T1025 control on its own |
| Minimal data on media | NHI Mgmt Group recommendation | Wipe drives after transfer so a later insertion does not expose old files (TajMahal and USBStealer harvest what was left behind) |
Decision guidance
- Small organisations: block removable storage by default with an exception group, and turn on Audit Removable Storage for the exceptions. That covers most of the risk with little effort.
- Large organisations: use device control with per-group read and write rules, collect device control events centrally, and alert on the mount-then-sweep sequence.
- Air-gapped and classified networks: treat every drive as a possible courier in both directions. Use transfer stations, serial-number allowlists and one-way paths, and log every read.
- OT environments: media is often the only way to patch; see the ICS view in MITRE ATT&CK for ICS T0847 Replication Through Removable Media.
Where identity fits
Media still carries machine credentials: exported certificates and private keys moved to offline systems, recovery keys, licence files with API keys, configuration bundles for appliances. If a host harvesting media sees one of these, that credential is exposed. Never move private keys or secrets on general-purpose drives; use hardware tokens or a controlled key ceremony. See the USB PKI tokens and eTokens guide for the hardware option.
How to test and roll out
- Inventory need: list which groups and host types genuinely need removable media, and in which direction.
- Audit first: deploy device control in audit mode and enable Audit Removable Storage on a pilot ring to see real usage.
- Emulate: on a pilot host, an authorised tester runs a benign script mapped to T1025 that reads test documents from a test drive on mount and copies them to a temp folder; confirm the analytics fire.
- Enforce in rings: deny read and write for host types with no need, then allowlist approved drives for the rest.
- Roll back: switch a device control policy back to audit for an affected group if a business process breaks, then add a scoped exception rather than removing the policy.
Metrics
- Share of endpoints and servers where removable storage read is denied or limited to allowlisted devices.
- Number of removable media mounts per week on hosts in sensitive zones.
- Mount-then-sweep alerts and time to triage.
- Share of media transfers into segregated networks that went through a transfer station.
Common failure patterns
- Write-only thinking: blocking copies to USB while allowing any process to read inserted media.
- Trusting encrypted drives: encryption protects a lost drive, not one mounted on an infected host.
- Air gap without media control: the network is isolated but drives move freely between it and office machines.
- Old files left on drives: reused media carries data from previous transfers.
- Logging mounts but not reads: you know a drive was inserted, not what was taken from it.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1025; TA0009; DET0511; M1057 | Technique, detection strategy, mitigation |
| MITRE ATT&CK (related) | T1120; T1091; T1052.001; T1119; M1034 | Discovery, replication, exfiltration and hardware control |
| NIST SP 800-53 Rev 5 | MP-2 Media Access; MP-7 Media Use; MP-4 Media Storage | Who and what may use media |
| NIST SP 800-53 Rev 5 | AU-12 Audit Record Generation; SI-4 System Monitoring | Media access logging and monitoring |
| NIST CSF 2.0 | PR.DS-01; DE.CM-09 | Data at rest and endpoint monitoring |
Practitioner checklist
- Enable Audit Removable Storage (Success and Failure) on Windows hosts that allow media.
- Collect device control events centrally and alert on the mount-then-sweep sequence.
- Deny removable storage read on servers, kiosks and hosts with no business need.
- Allowlist approved drives by serial number where media is needed.
- Route media into air-gapped networks through a scanning transfer station.
- Wipe transfer media after each use.
- Never carry private keys or secrets on general-purpose drives.
Standards and references
- MITRE ATT&CK: Data from Removable Media (T1025)
- MITRE ATT&CK: Data Loss Prevention (M1057)
- Microsoft: Audit Removable Storage
- Microsoft: Device control in Microsoft Defender for Endpoint
- USBGuard project
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Removable Media and USB Control Guide · ATT&CK Collection Tactic Guide · USB Drop Attacks Guide · Endpoint DLP Guide · MITRE ATT&CK T1091 Replication Through Removable Media · MITRE ATT&CK T1092 Communication Through Removable Media · MITRE ATT&CK T1052 Exfiltration Over Physical Medium · MITRE ATT&CK T1005 Data from Local System