Deployable detection rules
1 vendor-native detections · ready to paste into your SIEM · cross-linked to ATT&CK
◈
Detections
1 shown of 1Execution from a Removable Media with Network Connection
Identifies process execution from a removable media and by an unusual process. Adversaries may move onto systems,
possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of
Autorun features when the media is inserted into a system and executes.
Show query
sequence by process.entity_id with maxspan=5m
[process where host.os.type == "windows" and event.action == "start" and
/* Direct Exec from USB */
(process.Ext.device.bus_type : "usb" or process.Ext.device.product_id : "USB *") and
(process.code_signature.trusted == false or process.code_signature.exists == false) and
not process.code_signature.status : ("errorExpired", "errorCode_endpoint*")]
[network where host.os.type == "windows" and event.action == "connection_attempted"]
Showing 1-1 of 1