Executable File Copied to Removable Drive Share

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects when an executable file (.exe) is copied to a share associated with a removable drive (indicated by 'USBSTOR') over the SMB protocol. This could indicate an attempt to transfer malicious executables to or from a removable device.