Threat intelligence / Mitigation

Replication Through Removable Media Mitigation

Disable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if it is not required for business operations. (Citation: TechNet Removable Media Control) Identify potentially malicious software that may be used to infect removable media or may result from tainted removable media, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Mitigation

TypeMitigation

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Disable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if it is not required for business operations. (Citation: TechNet Removable Media Control) Identify potentially malicious software that may be used to infect removable media or may result from tainted removable media, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

0 recorded

Relationships

No relationships recorded.

8 external

References

mitre-attack

T1091

Microsoft Disable Autorun

https://support.microsoft.com/en-us/kb/967715

TechNet Removable Media Control

https://technet.microsoft.com/en-us/library/cc772540(v=ws.10).aspx

Beechey 2010

http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599

Windows Commands JPCERT

http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html

NSA MS AppLocker

https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm

Corio 2008

http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx

TechNet Applocker vs SRP

https://technet.microsoft.com/en-us/library/ee791851.aspx