| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | S | 456 | Infected Memory |
| CanPrecede | S | 529 | Malware-Directed Internal Reconnaissance |
Determine Target System
In certain cases, the adversary will explore an organization's network to determine a specific target machine to exploit based on the information it contains or privileges the main user may possess.
| Technique |
|---|
| If needed, the adversary explores an organization's network to determine if any specific systems of interest exist. |
Develop or Obtain malware and install on a USB device
The adversary develops or obtains the malicious software necessary to exploit the target system, which they then install on an external USB device such as a USB flash drive.
| Technique |
|---|
| The adversary can develop or obtain malware for to perform a variety of tasks such as sniffing network traffic or monitoring keystrokes. |
Connect or deceive a user into connecting the infected USB device
Once the malware has been placed on an external USB device, the adversary connects the device to the target system or deceives a user into connecting the device to the target system such as in a USB Drop Attack.
| Technique |
|---|
| The adversary connects the USB device to a specified target system or performs a USB Drop Attack, hoping a user will find and connect the USB device on their own. Once the device is connected, the malware executes giving the adversary access to network traffic, credentials, etc. |
| Scope | Likelihood | Impact | Note |
|---|
| Taxonomy Name | Entry ID | Entry Name |
|---|---|---|
| ATTACK | 1091 | Replication Through Removable Media |
| ATTACK | 1092 | Communication Through Removable Media |