Malicious removable media

An adversary uses removable media to transfer or propagate malware to another system. This can include copying files to removable media, legacy AutoRun behavior where the device, driver, OS version, and policy support it, or a user opening a file. Device insertion alone does not establish that a file executed; AutoRun and AutoPlay behavior depends on OS, media, driver, and policy, and may require user interaction. Exfiltration over USB is a separate technique (T1052.001).