DET0733 Detection of Replication Through Removable Media

Technique Detected: T0847 (Replication Through Removable Media)

Analytics

ICS

AN1866

Monitor for newly executed processes that execute from removable media after it is mounted or when initiated by a user. If a remote access tool is used in this manner to move laterally, then additional actions are likely to occur after execution, such as opening network connections for Command and Control and system and network information Discovery. Monitor for newly constructed files copied to or from removable media. Monitor for newly constructed drive letters or mount points to removable media. Monitor for files accessed on removable media, particularly those with executable content.

Log Sources

Mutable Elements