AN0841
Analytic 0841
Windows
Execution of files originating from removable media after drive mount, with correlation to file write activity, autorun usage, or lateral spread via staged tools.
WinEventLog:System
EventCode=1006
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
WinEventLog:Microsoft-Windows-Windows Defender/Operational
Suspicious file execution on removable media path
[DriveLetterMatch]
Detect activity on mounted drives typically used by USB (e.g., E:, F:, G:). Tune based on enterprise usage.
[FileExecutionWindow]
Set timing threshold for execution shortly after drive mount (e.g., < 5 minutes).
[ParentProcess]
Restrict detection to suspicious process lineage like explorer.exe, powershell.exe, or unsigned binaries.
[FileEntropy]
Use entropy thresholding to detect packed/obfuscated payloads dropped to removable media.