Gamaredon PteroOdd/PteroPaste USB Propagation via LNK File Creation on Removable Media
Detects USB-based lateral movement and persistence techniques associated with the Gamaredon group (PteroOdd/PteroPaste). The rule monitors for the connection of removable media followed by the creation of LNK files targeting AppData/Temp directories or UNC paths by specific processes (Office, Scripting engines, PowerShell), and the subsequent creation or modification of autorun.inf files on the same removable device.
YARA-L
