Communication Through Removable Media
Removable-media communication relays commands or results through physical storage between compromised systems.
What it means
Removable-media communication relays commands or results through physical storage between compromised systems. Disconnected networks can still have indirect information paths.
An investigation example
An isolated workstation and a connected host repeatedly exchange small changing files through a reused device.
Evidence to examine
Examine file versions, device custody, insertion history, and related execution on both systems.
A common analytical pitfall
Removable storage movement can be legitimate; repeated transfers require evidence of unauthorized command or data handling.
Response considerations
Preserve the exchange sequence and review media controls without assuming network isolation alone prevented communication.
A control message need not cross a live network
Removable media can carry information between systems that do not communicate directly. In a command-and-control context, the media may transport instructions or results as it moves between devices. This differs from simply copying valuable data onto a drive for removal. The role of the content and the sequence across hosts matter.
Ordinary file exchange and maintenance also use removable storage. Investigators should identify device context, mount or attachment events, file operations, process activity, and authorized workflow. A drive being present does not prove that it carried commands or that every connected host was affected.
A fictional disconnected training system
An academy uses removable media to move approved course material to an isolated lab. During an investigation, analysts find unexpected files created on the media by one host and read by an unfamiliar process on another. They preserve relevant device and file records and examine the content through an approved analysis route.
The relationship may be difficult to reconstruct because clocks, device identifiers, and retention differ across hosts. Document those limitations and distinguish a plausible transport path from demonstrated execution. Do not connect unknown media to a personal computer to inspect it casually; handling should follow the authorized evidence procedure.
Map a two-host sequence
Using fictional records, draw a drive moving from host A to host B and back. Label attachment, file creation, file read, and process events separately. State what evidence would support a command-and-result relationship rather than ordinary document exchange. A paper scenario or prepared training image is sufficient.
Defensive planning should consider approved transfer processes, device handling, and monitoring where appropriate. A disconnected network boundary reduces some paths but does not remove every information flow. Understand the actual media workflow before making broad claims that isolation alone guarantees no communication can occur.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1092: Communication Through Removable Media