---
{
  "title": "Replication Through Removable Media",
  "summary": "Removable-media replication carries malicious content between systems through attached storage.",
  "topic": "soc",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    6
  ],
  "aliases": [
    "T1091"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1091: Replication Through Removable Media",
      "url": "https://attack.mitre.org/techniques/T1091"
    }
  ],
  "editorialVersion": 2
}
---

## Storage can carry content between systems

Replication through removable media moves malicious content between systems using attached storage. It can matter where ordinary network paths are unavailable or restricted. The content may execute through platform behavior or a user's action, depending on the system and how the material is presented.

The presence of a USB drive does not establish infection. Investigators need evidence of the device connection, relevant files, access or execution, and the relationship between systems. Modern platform settings and configurations affect what can happen automatically, so avoid assuming every inserted drive runs code.

## One drive appears in two timelines

In a fictional office, an external drive is connected to a workstation and later to a separate system. A suspicious file appears on the second system. The analyst reviews device and volume identifiers, connection times, file metadata and hashes where available, and execution records.

An approved file transfer could explain the sequence. The team asks what material was intentionally moved and compares it with the observed artifact. A matching filename is weaker evidence than supported content identity and a consistent movement timeline.

Determine whether the suspicious content merely arrived, was opened, or executed. These stages have different implications for the second system's status. A device connection alone should not be described as confirmed compromise.

## Distinguish data collection from propagation

[[data-from-removable-media]] concerns reading information from the attached storage. Replication concerns content carried to another system. A single case may involve both, but each requires its own evidence.

Review shortcuts, executable content, documents, and other artifacts according to what was actually observed. Misleading presentation may be relevant through [[masquerading]], while [[user-execution]] explains a human action that activates content.

Handle the media through an authorized process. Avoid inserting unknown storage into an ordinary workstation for inspection, and preserve identifying details and custody where required. Acquisition or analysis may change artifacts if performed carelessly.

## Stop the movement path

Restrict affected systems and the media as justified, investigate the original access, and review other systems that used the same device during the relevant period. Do not assume every past connection led to execution; prioritize evidence and supported exposure windows.

Coordinate device-control changes with business owners because removable storage may support legitimate operational needs. Recovery should address infected systems and the content that could reintroduce the problem.

For practice, compare a harmless document transfer with a fictional executable carried between two hosts. Identify connection, artifact, interaction, and execution evidence needed to establish each stage. [[incident-response]] coordinates the scope, while [[incident-reporting]] separates possible contact from confirmed propagation and execution.

## Related concepts

- [[mitre-attack]]
- [[logs-and-telemetry]]