Execution from External Media (Windows)
Detects the execution of a process from a newly connected external media device on Windows. This rule correlates the detection of a new Plug and Play (PnP) device with a drive letter (excluding C:\) and subsequent process creation from that drive letter. It requires Plug and Play auditing to be enabled.
Sigma
