Techniques › T1092 › AN0248
AN0248 Analytic 0248
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of file write-access to USB-mount directories (e.g., /media/, /run/media/) followed by same-file access or execution on another host.</p>
- Detects
- T1092 Communication Through Removable Media
- Part of
- DET0090 Cross-host C2 via Removable Media Relay
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | write/open, FIM audit | DC0039 File Creation |
| auditd:SYSCALL | Removable media mount notification | DC0042 Drive Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
MountPathPattern | Typical mount paths to monitor (e.g., /media/usb*, /run/media/username/*). |
TimeWindowBetweenHosts | Tunable detection window to correlate read/write between different hosts within a short interval (e.g., <15m). |