RUSTYMOVE Removable Drive Enumeration via Embedded PowerShell

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•1

Detects the use of PowerShell cmdlets and parameters to perform system, hardware, and external drive discovery. This includes querying volume information, disk/partition details, and checking for removable or specific bus-type media (USB, SD, MMC), which is commonly associated with reconnaissance activities by an adversary.