Replication Through Removable Media (T1091)

Arnold Chan@slaz

•updated 27 days ago•0•0•1

Detects file creation on a removable drive followed by process execution from that drive shortly after mounting.