Senses

Data from Removable Media · SynAc

TERM

Data from Removable Media

Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.

Updated

Jan 03, 2026

Senses

Sense 1

Some adversaries may also use Automated Collection on removable media.

MITRE ATT&CK (CTI STIX Data)

Bibliography

MITRE ATT&CK (CTI STIX Data)
Accessed Jan 03, 2026Quoted
MITRE ATT&CK CTI (STIX bundle)
https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json
See repository LICENSE.txt for ATT&CK terms: non-exclusive royalty-free license; reproduce MITRE copyright + license in copies. Verify requirements before publishing quoted text.
Source: MITRE ATT&CK (attack-stix-data).