T1091 Replication Through Removable Media

Technique: T1091
Tactics: Lateral Movement, Initial Access
Research, 90 days: 1
KEV CVEs mapped: 6
SigmaHQ rules: 1
Elastic, Splunk: 7
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1091

MITRE description

Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself. Mobile devices may also be used to infect PCs with malware if connected via USB.(Citation: Exploiting Smartphone USB ) This infection may be achieved using devices (Android, iOS, etc.) and, in some instances, USB charging cables.(Citation: Windows Malware Infecting Android)(Citation: iPhone Charging Cable Hack) For example, when a smartphone is connected to a system, it may appear to be mounted similar to a USB-connected disk drive. If malware that is compatible with the connected system is on the mobile device, the malware could infect the machine (especially if Autorun features are enabled).

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-15 GuidePoint GRIT: Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew

Detection coverage

SigmaHQ community rules

External Disk Drive Or USB Storage Device Was Recognized By The System (core)

Elastic and Splunk rules

New USB Storage Device Mounted (elastic)
Execution from a Removable Media with Network Connection (elastic)
First Time Seen Removable Device (elastic)
Windows Process Executed From Removable Media (splunk)
Windows Replication Through Removable Media (splunk)
Windows USBSTOR Registry Key Modification (splunk)
Windows WPDBusEnum Registry Key Modification (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.