ATT&CK technique
View on MITRE ATT&CK →
T1091
Replication Through Removable Media
Lateral MovementInitial Access
8 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | First Time Seen Removable Device | production | 2026-09-18 |
| elastic | New USB Storage Device Mounted | production | 2026-09-18 |
| elastic | Execution from a Removable Media with Network Connection | production | 2026-09-18 |
| splunk | Windows USBSTOR Registry Key Modification | production | 2026-05-13 |
| splunk | Windows WPDBusEnum Registry Key Modification | production | 2026-05-13 |
| splunk | Windows Process Executed From Removable Media | production | 2026-05-13 |
| splunk | Windows Replication Through Removable Media | production | 2026-05-13 |
| sigma | External Disk Drive Or USB Storage Device Was Recognized By The System | test | 2024-02-09 |