AN2066: Analytic 2066
Monitor for newly constructed drive letters or mount points to removable media. Monitor for newly executed processes that execute from removable media after it is mounted or when initiated by a user.
Analyst context for executives and security teams
This analytic is about recognizing when removable media is mounted and when programs run from that newly mounted media. For security leaders, the value is not just malware detection; it is validating whether the organization can see a common bridge between physical access, user action, and cyber execution in ICS environments. If removable media is part of operations, maintenance, vendor support, or file transfer workflows, lack of visibility can leave incident responders unable to reconstruct how code entered the environment.
Executive priority
Prioritize this as a control-validation and evidence question: do teams know when removable media is introduced, mounted, and used to execute processes? The answer affects incident scoping, audit defensibility, removable-media governance, and cyber-physical risk management in ICS settings. Because ATT&CK provides no platform, tactic, or relationship context for this analytic, leaders should treat it as a prompt to validate local telemetry and policy coverage rather than as proof of a specific threat scenario.
Technical view
SOC, detection engineering, and IR teams should validate monitoring for newly created drive letters or mount points associated with removable media, then correlate those events with process execution from the mounted path, especially execution initiated shortly after mount or by an interactive user. Since no official detection logic is supplied, teams should build environment-specific logic around mount activity followed by process creation from the removable media location, with tuning for authorized maintenance, engineering, backup, and file-transfer workflows.
Likely telemetry
- Removable media insertion or mount events
- New drive letter or mount point creation records
- Process creation or execution telemetry including executable path
- User/session context for process initiation
- Timestamp correlation between media mount and execution
Detection direction
- Validate that telemetry exists for both removable media mount activity and subsequent process execution; either source alone may be insufficient.
- Correlate new mount points or drive letters with processes whose image path or working directory resides on the removable media.
- Tune against approved operational workflows, such as maintenance or user-initiated file transfer, to reduce false positives without suppressing high-risk execution events.
- Confirm whether monitoring covers the specific systems and enclaves where removable media is permitted, restricted, or operationally necessary.
- Because ATT&CK supplies no platforms or tactics for this object, avoid assuming operating-system-specific event IDs or complete coverage without local testing.
Mitigation priorities
- Define and enforce removable-media usage policy for ICS and supporting systems, including where execution from removable media is allowed or prohibited.
- Ensure logging is enabled for media mount activity and process execution on in-scope assets before relying on this analytic for detection.
- Establish approval and documentation workflows for legitimate removable-media use so SOC teams can distinguish expected activity from suspicious execution.
- Review incident response playbooks to include collection of mount history, user context, and executed file paths when removable media is involved.
- Use periodic control testing to confirm that mounting media and executing a test benign file produces the expected alerts and investigation evidence.
Analyst notes and limits
The supplied ATT&CK object is a detection analytic in the ICS ATT&CK domain. Its official description focuses on monitoring newly constructed drive letters or mount points for removable media and newly executed processes from that media after mounting or user initiation. No official detection field, platforms, tactics, labels, aliases, or relationships were provided, so this take emphasizes validation questions and telemetry requirements rather than a specific detection implementation.
This summary is limited to the supplied STIX fields and the single MITRE external reference for AN2066. It does not establish affected platforms, adversary use, active exploitation, specific ATT&CK tactics, or guaranteed detection coverage. Local architecture, logging configuration, removable-media policy, and operational workflows are required to determine priority and detection fidelity.
Analytic 2066
Monitor for newly constructed drive letters or mount points to removable media. Monitor for newly executed processes that execute from removable media after it is mounted or when initiated by a user.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 7cadb7d87405… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN2066Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.