GammaSteel WMI USB Monitoring via PowerShell
Detects PowerShell script execution utilizing WMI event subscription (Register-WmiEvent) explicitly targeting the creation of logical disks with DriveType 2 (USB drives). This technique is known to be used by the GammaSteel threat group to monitor and potentially steal data from physical media.
Microsoft Sentinel (KQL)
