Procedure examples

QuietSieve can identify and search removable drives for specific file name extensions.

Stuxnet enumerates removable drives for infection.

SharpDisco has dropped a plugin to monitor external drives to `C:\Users\Public\It3.exe`.

Crimson has the ability to discover pluggable/removable drives to extract files from.

DynoWiper has enumerated and overwritten files on all removeable and fixed drives.

Turian can scan for removable media to collect data.

Machete detects the insertion of new devices by listening for the WM_DEVICECHANGE window message.

A module in Prikormka collects information on available printers and disk drives.

FlawedAmmyy will attempt to detect if a usable smart card is current inserted into a card reader.

WastedLocker can enumerate removable drives prior to the encryption process.

AcidPour includes functionality to identify MMC and SD cards connected to the victim device.

CHIMNEYSWEEP can monitor for removable drives.

Ragnar Locker may attempt to connect to removable drives and mapped network drives.

BlackEnergy can gather very specific information about attached USB devices, to include device instance ID and drive geometry.

ObliqueRAT can discover pluggable/removable drives to extract files from.

DarkWatchman can list signed PnP drivers for smartcard readers.

PlugX can identify removable media attached to compromised hosts.

DustySky can detect connected USB devices.

Mongall can identify removable media attached to compromised hosts.

LockBit 3.0 has the ability to discover external storage devices.

SVCReady can check for the number of devices plugged into an infected host.

Ferocious can run GET.WORKSPACE in Microsoft Excel to check if a mouse is present.

USBferry can check for connected USB devices.

WannaCry contains a thread that will attempt to scan for new attached drives every few seconds. If one is identified, it will encrypt the files on the attached device.

Bandook can detect USB devices.

T9000 searches through connected drives for removable storage devices.

Attor has a plugin that collects information about inserted storage devices, modems, and phone devices.

NightClub has the ability to monitor removable drives.

Crutch can monitor for removable drives being plugged into the compromised machine.

RTM can obtain a list of smart card readers attached to the victim.

MoonWind obtains the number of removable drives from the victim.

LockBit 2.0 has the ability to identify mounted external storage devices.

Zebrocy enumerates information about connected storage devices.

Cadelspy has the ability to steal information about printers and the documents sent to printers.

USBStealer monitors victims for insertion of removable drives. When dropped onto a second victim, it also enumerates drives connected to the system.

TajMahal has the ability to identify connected Apple devices.

Ramsay can scan for removable media which may contain documents for collection.

The FunnyDream FilepakMonitor component can detect removable drive insertion.

ROADSWEEP can identify removable drives attached to the victim's machine.

njRAT will attempt to detect if the victim system has a camera during the initial infection. njRAT can also detect any removable drives connected to the system.

HIUPAN has checked periodically for removable drives and installs itself when a drive is detected.

Heyoka Backdoor can identify removable media attached to victim's machines.

BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.

QakBot can identify peripheral devices on targeted systems.

jRAT can map UPnP ports.

INC Ransomware can identify external USB and hard drives for encryption and printers to print ransom notes.

ADVSTORESHELL can list connected devices.