MITRE ATT&CK T1092: Communication Through Removable Media (Enterprise Tactic TA0011 - Command and Control)

What MITRE ATT&CK T1092: Communication Through Removable Media (Enterprise Tactic TA0011 - Command and Control) requires

MITRE ATT&CK T1092 (Communication Through Removable Media) is an Enterprise Command and Control technique. Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system. Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by Replication Through Removable Media. Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access. Affected platforms: Linux, macOS, Windows. MITRE-documented mitigations include M1042 Disable or Remove Feature or Program, M1028 Operating System Configuration. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls CM-02, CM-06, CM-07, CM-08, MP-07, RA-05, SI-03, SI-04.

Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated: 2026-05-25

Primary source: https://attack.mitre.org/techniques/T1092/

SHA-256 integrity: 2dbeb6f70071d837a9d5c36e024eca591192196b2ae404c1adb8a000ce95bcbd

Primary Citations — 7 traced to source

• MITRE ATT&CK Technique T1092: Communication Through Removable Media (https://attack.mitre.org/techniques/T1092/)
• MITRE ATT&CK Tactic TA0011: Command and Control (https://attack.mitre.org/tactics/TA0011/)

+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.

Access

• Discovery (free): /api/v1/nodes/mitre-attack-t1092-communication-through-removable-media.json — 6-field metadata
• Vault (full node): /api/v1/vault/nodes/mitre-attack-t1092-communication-through-removable-media.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
• Canonical URL: https://bidda.com/intelligence/mitre-attack-t1092-communication-through-removable-media
• Back to registry: Browse all 10,085 compliance nodes