Autorun File Written to Removable Media Share

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects the writing of an 'autorun.inf' file to a Server Message Block (SMB) share, specifically targeting removable media shares. The presence of 'autorun.inf' on removable media is often associated with malware attempting to auto-execute when the media is inserted into a Windows system.