Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
76 detections
Filters
Last updated
All Time
Detection languages
33
13
11
5
4
Contributors
23
13
7
7
6
Categories
45
38
14
12
10
Platforms
72
4
Products / Services
39
18
5
4
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
4
IDS Protocols
2
1
1
Detects USB-based lateral movement and persistence techniques associated with the Gamaredon group (PteroOdd/PteroPaste). The rule monitors for the connection of removable media followed by the creation of LNK files targeting AppData/Temp directories or UNC paths by specific processes (Office, Scripting engines, PowerShell), and the subsequent creation or modification of autorun.inf files on the same removable device.
This rule detects the connection of USB devices identified as suspicious based on a curated list of Vendor IDs (VIDs) and Product IDs (PIDs). It monitors 'PnpDeviceConnected' events, extracts VID and PID from the device information, and cross-references them with an external list of known suspicious USB device identifiers. The rule aims to identify potentially malicious or unauthorized USB devices being connected to endpoints.
This rule detects two common persistence techniques: the modification of Windows Registry Run keys with paths referencing temporary or application data directories, and the creation of autorun.inf files on removable or non-system drives to facilitate potential code execution upon media insertion.
Detects LCRYX ransomware components attempting to propagate through the network using WMI Win32_Process execution over SMB admin shares, and monitors for the creation of USB_bridge.vbs scripts, commonly associated with removable media infection vectors.
This rule detects the creation of specific disguised .lnk files (e.g., ChromeSetup.lnk, Firefox Installer.lnk, AnyDesk.lnk) which are known to be used by the DeepLoad malware for USB-based lateral movement.
Detects large data transfers to removable storage media for physical exfiltration
This rule detects patterns indicative of a USB autorun payload download. Specifically, it looks for HTTP traffic (flow:to_client,established) containing the strings "[autorun]" and "open=" (case-insensitive) within the file data. This combination suggests a client is receiving a file that attempts to leverage the autorun feature, often used by malware for initial execution from removable media.
This rule detects suspicious file drops over SMB (port 445) that contain both ".lnk" (likely a shortcut file) and "System32" in their content. This combination is often indicative of malware attempting to spread via removable media, using shortcut files to execute malicious payloads, potentially mimicking legitimate system directories.
This rule detects the writing of an 'autorun.inf' file to a Server Message Block (SMB) share, specifically targeting removable media shares. The presence of 'autorun.inf' on removable media is often associated with malware attempting to auto-execute when the media is inserted into a Windows system.
Detects autorun.inf files written to removable media for self-propagation
This rule detects when an executable file (.exe) is copied to a share associated with a removable drive (indicated by 'USBSTOR') over the SMB protocol. This could indicate an attempt to transfer malicious executables to or from a removable device.
Detects the creation or modification of the 'FsTx' directory within 'System Volume Information' on any volume, which is a staging step required by the YellowKey BitLocker bypass (Windows 11, Server 2022/2025). The attacker copies the FsTx folder to either a USB stick's System Volume Information directory OR the target machine's EFI System Partition, then reboots into WinRE while holding CTRL to trigger a shell with unrestricted access to the BitLocker-protected volume. The FsTx folder name has no legitimate use; modifications to System Volume Information by non-system processes are inherently suspicious.
Detects the creation or modification of the 'FsTx' directory within 'System Volume Information' on any volume, which is a staging step required by the YellowKey BitLocker bypass (Windows 11, Server 2022/2025). The attacker copies the FsTx folder to either a USB stick's System Volume Information directory OR the target machine's EFI System Partition, then reboots into WinRE while holding CTRL to trigger a shell with unrestricted access to the BitLocker-protected volume. The FsTx folder name has no legitimate use; modifications to System Volume Information by non-system processes are inherently suspicious.
Detects the creation of specific disguised shortcut (.lnk) files on drives, indicative of DeepLoad's USB propagation mechanism. DeepLoad spreads to adjacent endpoints by dropping over 40 disguised .lnk files onto connected USB drives.
This rule detects the connection of external Plug and Play (PnP) devices, including USB storage, to a system. It identifies events where a USB drive is mounted or a generic PnP device is connected, extracting details such as vendor, product ID, and serial number for investigation.
Detects the execution of a process from a newly connected external media device on Windows. This rule correlates the detection of a new Plug and Play (PnP) device with a drive letter (excluding C:\) and subsequent process creation from that drive letter. It requires Plug and Play auditing to be enabled.
Detects the execution of a script file (e.g., VBS, JS, BAT, PS1) from a removable drive using a common script interpreter. This technique is used by the threat actor Tangerine Turkey for initial access.
This analytic is used to identify when a removable media device is attached to a machine and then a process is executed from the same drive letter assigned to the removable media device. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
This rule identifies when a USB removable media device is attached to a Windows host by monitoring modifications to the HKLM\System\CurrentControlSet\Enum\USBSTOR\ registry key. Adversaries and insider threats may use removable media devices for various malicious activities, including initial access, execution, and data exfiltration.
This analytic is used to identify when a USB removable media device is attached to a Windows host. It queries the Endpoint Registry data model to look for modifications to the Windows Portable Device keys HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
The following analytic detects the creation or dropping of executable or script files in the root directory of a removable drive. It leverages data from the Endpoint.Filesystem datamodel, focusing on specific file types and their creation paths. This activity is significant as it may indicate an attempt to spread malware, such as ransomware, via removable media. If confirmed malicious, this behavior could lead to unauthorized code execution, lateral movement, or persistence within the network, potentially compromising sensitive data and systems.
Page 3 of 4