WMI Drive Discovery By MediaType
Detects a specific WMI query used by GammaWorm to find network drives and low-cost USB drives for malware propagation by filtering for mediatype=null. This query targets 'win32_logicaldisk' and specifically looks for drives where 'mediatype=null', which can indicate network or removable drives.
Cortex XDR
