Malicious files, removable media and device content
V05 · reusable vector · version 1.0HIGH · proposed test impact
A file, attachment or peripheral is used to exploit software or induce execution; a lost unencrypted device can also expose data without a software exploit.
Attacker tools and payload types
A document, script, malicious image or device content. Use inert canaries and approved samples for assessment; do not reproduce spyware or malware.
The entries below are tools that can support assessment or emulate aspects of this vector in an authorised fixture. They are not claims that these exact products were used in every linked incident. Native platform availability and Armory installation are different from tested capability.
- MVT · native service; handoff is not automatic execution
- Client endpoint/device-control console · client/operator supplied
Repository and operating guides
canary.txt · RES-022 · published synthetic fixture in the assessment collection linked from the Repository.
Read the selected tool’s guide for installation and operation rather than recreating it here. Pin the deployed version and reviewed configuration in the task record. Some local guides are autogenerated inventory notes and contain stale commands or broad prerequisite lists; they require validation before use. The official manuals linked above were checked during this review.
Reusable controlled test
Review policy and supported software, then use benign test files/devices on an isolated endpoint. For forensics, analyse consented working copies and record detection limits.
- Required permission
- Named test endpoint/device, file class, acquisition authority and data scope; no automatic approval to execute attachments.
- Parent supplies
- Scenario/risk ID; business question; exact targets; named permitted people; channel; current policy revision; tool/resource versions; limits; expected result and reviewer.
- Output
- One result per approved case, with run and target IDs, permission decision, evidence, actual outcome and coverage limits.
- Measure
- Correct device/file-control outcomes / executed cases; evidence integrity; supported analysis coverage. No client result has been collected here.
- Failure handling
- Blocked, not authorised, failed, inconclusive and not tested remain visible. A refused route cannot be replaced by another agent, channel or target without fresh applicable approval.
What the vector returns to the scenario
| Result | What it means |
|---|---|
| Control held | The evidenced attempted action was prevented under the tested conditions. This is not a universal security guarantee. |
| Control failed | Describe the exact observed boundary failure and its business consequence, without inflating it into a wider compromise. |
| Unknown / not tested | Record the missing capability, evidence, permission or coverage. Do not invent a score. |
Mitigation recommendations
Reduce likelihood: Reduce unsafe execution paths, maintain supported software and control removable media.
Reduce impact: Limit endpoint privilege, protect portable data and preserve response evidence.
Define how a later retest would verify the recommendation; implementation assignments, scheduling and pricing are Part 2.