PlugX USB Drop - Executable Created on Removable Media Followed by Immediate Process Execution
Detects the creation of executable files (.exe or .dll) on a removable drive followed by the execution of a process from that same drive within a 30-second window. This behavior is indicative of an adversary using removable media to stage and execute malicious payloads.
Splunk (SPL)
