Oliver W
@oliverw0 followers14 downloads1 copy0 likes53 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
1
Detects the execution of a process from a newly connected external media device on Windows. This rule correlates the detection of a new Plug and Play (PnP) device with a drive letter (excluding C:\) and subsequent process creation from that drive letter. It requires Plug and Play auditing to be enabled.
