Replication Through Removable Media: USB Mount, Write, Execute - CORTEXQL
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
Cortex XDR
