WMI Query For Network And Removable Drives
Detects a specific WMI query used by malware, such as Gamaredon's GammaWorm, to discover network drives (e.g., SMB mounts) and low-cost USB drives for malware propagation by filtering for mediatype=null.
Sigma
