Replication through removable media
Malware spreads via autorun on USB drives
categoryMalwareseverityHighdetectability (measured in our lab)Mediumlabdetected in lab
Example: Stuxnet
Detection opportunity what to watch for
A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.
What the attacker runs
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1091 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1091 -TestGuids d44b7297-622c-4be8-ad88-ec40d7563c75 -TimeoutSeconds 120'powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1091 -Tool atomic -RunId run-2026-10-14-020 -Command 'Invoke-AtomicTest T1091 -TestGuids d44b7297-622c-4be8-ad88-ec40d7563c75 -TimeoutSeconds 120'powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1091 -Tool atomic -RunId run-2026-10-18-021 -Command 'Invoke-AtomicTest T1091 -TestGuids d44b7297-622c-4be8-ad88-ec40d7563c75 -TimeoutSeconds 120'+ 2 more test variant(s) in the corpus.
What our lab measured
detected windows · 2026-10-30 · detected in 39s
What it looked like in telemetry
| Log source | What it means |
|---|---|
| Sysmon · EID 1 | PowerShell enumerates removable drives (Win32_LogicalDisk DriveType=2) and writes files to them (removable-media spread) -- T1091 |
| Sysmon · EID 11 | Executable file dropped in folder commonly used by malware |
| PowerShell · EID 4104 | Powershell script querying system environment variables |
| PowerShell · EID 4104 | Powershell script recursively collected files from a filesystem search |
| PowerShell · EID 4104 | Powershell script searching filesystem |
| PowerShell · EID 4104 | Powershell script used "Invoke-command" cmdlet to execute sub script |
| Security · EID 4624 | Non network or service local logon. |
| Security · EID 4634 | Non service account logged off. |
| … and 4 more event type(s) | |
Detection that fired
- ✓ Wazuh
100436(level 8) lab rule — PowerShell enumerates removable drives (Win32_LogicalDisk DriveType=2) and writes files to them (removable-media spread) -- T1091 - ✓ Wazuh
100437(level 8) lab rule — PowerShell enumerates removable drives (Win32_LogicalDisk DriveType=2) and writes files to them (removable-media spread) (Security 4688 arm) -- T1091
Plus 10 stock Wazuh/Sysmon rule(s) in the window.
Background noise in the window: ~5515 incidental alerts/hour — tune against this.
partially detected windows · 2026-10-27
What it looked like in telemetry
| Log source | What it means |
|---|---|
| Sysmon · EID 1 | Powershell process spawned powershell instance |
| Sysmon · EID 11 | Executable file dropped in folder commonly used by malware |
| PowerShell · EID 4104 | Powershell script querying system environment variables |
| PowerShell · EID 4104 | Powershell script recursively collected files from a filesystem search |
| PowerShell · EID 4104 | Powershell script searching filesystem |
| PowerShell · EID 4104 | Powershell script used "Invoke-command" cmdlet to execute sub script |
| Security · EID 4624 | Non network or service local logon. |
| Security · EID 4634 | Non service account logged off. |
| … and 3 more event type(s) | |
Plus 11 stock Wazuh/Sysmon rule(s) in the window.
Background noise in the window: ~69855 incidental alerts/hour — tune against this.
Classification
28 values: 14 reviewed, 2 lab-measured, 8 imported, 4 derived. What do these mean?
Exploitability
| Attack vector | MalwarePhysical |
|---|---|
| Reach (CVSS) | Physical |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Passive |
| Attacker skill required | Low |
| Resources required | Low |
| Likelihood / prevalence | Low |
| Maturity | Established |
Impact & scope
| Severity | High |
|---|---|
| Impact | AvailabilityConfidentialityIntegrity |
| Platform | Windows |
| Environment | On-premisesOT / ICS |
| Target asset class | EndpointPhysical |
| Kill-chain phase (tactic) | Initial AccessLateral Movement |
Detection & telemetry
| Detectability (measured in our lab) | Medium |
|---|---|
| Detectability (public detection content) | Medium |
| Noise level | High |
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Drive CreationFile AccessFile CreationProcess Creation |
Detection & response
Mitigated by 6
- M1034 attack-mitigation
- M1040 attack-mitigation
- M1042 attack-mitigation
D3-HCId3fendD3-IOPRd3fendD3-RHd3fend
Detected by 4
- DET0301 attack-detection-strategy
f69a87ea-955e-4fb4-adb2-bb9fd6685632sigma100436wazuh100437wazuh
Tested by 1
d44b7297-622c-4be8-ad88-ec40d7563c75atomic
Lab findings
Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.
| Run | Outcome | Tool | Platform | Ran at |
|---|---|---|---|---|
run-2026-10-14-020 | partially-detected | atomic | windows | 2026-10-14 |
run-2026-10-18-021 | partially-detected | atomic | windows | 2026-10-18 |
run-2026-10-27-015 | partially-detected | atomic | windows | 2026-10-27 |
run-2026-10-30-003 | detected | atomic | windows | 2026-10-30 |
run-2026-10-14-020— Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1091 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=14 max_level=15 dwell_s=90run-2026-10-18-021— Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1091 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1490 max_level=15 dwell_s=90run-2026-10-27-015— Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1091 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1824 max_level=15 dwell_s=90run-2026-10-30-003— Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1091 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=2 incidental=144 max_level=15 dwell_s=90
Framework references
- Primary source: https://attack.mitre.org/tactics/TA0001/
- attack: T1091 (primary)
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 115 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 28 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0003 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-020 (partially-detected) for T1091: no alert matched the expected technique
- ev-0004 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-021 (partially-detected) for T1091: no alert matched the expected technique
- ev-0005 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-015 (partially-detected) for T1091: no alert matched the expected technique
- ev-0006 (Phase 4 detection lab - detonation runs 2026-10-30) — Lab detonation run-2026-10-30-003 (detected): Wazuh rule(s) 100436, 100437 fired on T1091 within the detonation window
PowerShell enumerates removable drives (Win32_LogicalDisk DriveType=2) and writes files to them (removable-media spread) -- T1091