Gamaredon PteroSetup USB/Network Drive Malware Propagation via wscript/powershell from Removable Media
This rule detects the execution of script files (.vbs, .ps1, .hta, .lnk, .exe) from potential removable media drives (drive letters D-Z) by common Windows interpreters (wscript.exe, cscript.exe, powershell.exe). It monitors for these processes being launched either as standalone processes or as children of other scripts, explorer.exe, or interpreters, while explicitly excluding paths typically associated with legitimate Windows system and program directories.
Splunk (SPL)
