Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information. Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on removable media.

Linked Issues

Issuelinks
Linktyp Issue
is related to Techniques
is blocked by Detection of Data Access and Collection from Removable Media
is blocked by Data Loss Prevention
is blocked by Data Backups
is blocked by Continuous Monitoring
is blocked by Use of Cryptographic Controls
is blocked by Encrypting Data At Rest
is blocked by Cybersecurity & Data Protection Attributes
is blocked by Media Use
is blocked by Data Mining Protection
is blocked by Information Location
is blocked by Malicious Code Protection (Anti-Malware)
is blocked by Port & Input / Output (I/O) Device Access
is blocked by Account Management
is blocked by Access Enforcement
is blocked by Least Privilege
is blocked by Secure Engineering Principles
is blocked by Operations Security
Impressum Deutsch Englisch