Detection rules › Splunk
Windows Process Executed From Removable Media
This analytic is used to identify when a removable media device is attached to a machine and then a process is executed from the same drive letter assigned to the removable media device. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1091 Replication Through Removable Media, T1200 Hardware Additions |
| Lateral Movement | T1091 Replication Through Removable Media |
| Collection | T1025 Data from Removable Media |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 1 | Process creation |
| Sysmon | 13 | RegistryEvent (Value Set) |
Stages and Predicates
Stage 1: tstats
tstats WHERE NOT Processes.process_current_directory IN ("*\\sysvol\\*", "C:\\*") Processes.process_current_directory="*" BY Processes.action, Processes.dest, Processes.original_file_name, Processes.parent_process, Processes.parent_process_exec, Processes.parent_process_guid, Processes.parent_process_id, Processes.parent_process_name, Processes.parent_process_path, Processes.process, Processes.process_exec, Processes.process_guid, Processes.process_hash, Processes.process_id, Processes.process_integrity_level, Processes.process_name, Processes.process_path, Processes.user, Processes.user_id, Processes.vendor_product, Processes.process_current_directory
Stage 2: search
search
Stage 3: rex
rex field=process_current_directory ...
Stage 4: where
where isnotnull(object_handle)
Stage 5: search
search
Stage 6: search
search
Stage 7: join
join type=inner (...)
Stage 8: search
search `macro`
Exclusions
Top-level NOT(...) conjuncts — predicates this rule actively suppresses.
| Stage | Field | Kind | Excluded values |
|---|---|---|---|
| 1 | CurrentDirectory | in | "*\\sysvol\\*", "C:\\*" |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Processes.process_current_directory | eq |
|
Registry.registry_path | eq |
|
Registry.registry_path | in |
|
Registry.registry_value_data | eq |
|