Writing to removable media

removable_media_write

Writes an EICAR file, a synthetic-PII canary, an autorun descriptor and a plain control file to a removable drive named by --usb-target, then reads them back and deletes them. Tests device control, removable-media scanning and DLP on removable media, which posture collection cannot answer. There is no default target: without --usb-target the test skips rather than guessing at a drive that might hold real data.

Severity high how bad it would be if it were real

Expected outcome Something should prevent it

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

--i-understand
Needs explicit consent: this test changes machine state or fetches real offensive tooling.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1052.001	Exfiltration over USB	Exfiltration	coverage statistics
T1091	Replication Through Removable Media	Lateral Movement	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.