AN0247
Analytic 0247
Windows
Behavioral sequence where removable media is mounted, files are written/updated, and subsequently read/executed on a separate host, suggesting removable-media relay communication.
WinEventLog:System
EventCode=1006
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
[RemovableDriveLetter]
Adjust drive letters used in detection (e.g., E:, F:, G:) depending on enterprise usage.
[WriteToReadTimeWindow]
Tunable window for file write on one host followed by file read or execution on another (e.g., within 10 minutes).
[FileNamePattern]
Common naming schemes for payload, tasking, or exfil files (e.g., task.txt, beacon.log, data.bin).
AN0248
Analytic 0248
Linux
Detection of file write-access to USB-mount directories (e.g., /media/, /run/media/) followed by same-file access or execution on another host.
auditd:SYSCALL
write/open, FIM audit
auditd:SYSCALL
Removable media mount notification
[MountPathPattern]
Typical mount paths to monitor (e.g., /media/usb*, /run/media/username/*).
[TimeWindowBetweenHosts]
Tunable detection window to correlate read/write between different hosts within a short interval (e.g., <15m).
AN0249
Analytic 0249
macOS
Correlates removable volume mounts (disk arbitration) with file I/O events on that volume, followed by same file execution shortly after insert.
macos:unifiedlog
com.apple.diskarbitration
fs:fsusage
open/write/exec calls
[VolumeNameFilter]
Known suspicious USB volume labels or types (e.g., NO NAME, SECUREDATA).
[ProcessContext]
Unusual processes accessing USB drives (e.g., bash, Python, unsigned binaries).