Gamaredon PteroOdd/PteroSetup USB Propagation via PowerShell LNK Write
Detects anomalous file activity on removable media drives characteristic of the Gamaredon group's PteroOdd/PteroSetup malware. The rule identifies PowerShell, wscript.exe, or cscript.exe writing autorun.inf or .lnk files to removable drive letters (D-Z), which is a common technique for lateral movement and propagation via USB drives.
Sigma
