Bulk file copy to USB removable media following mass storage insertion

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•0

Detects the insertion of a USB mass storage device (mounted drive) followed closely within a 2-hour window by bulk file creation or modification activities (50 or more files) on that same removable drive letter. This behavior can indicate data staging and exfiltration using removable media.