SHIPSHAPE S0028

Type: malware
Created: 31 May 2017
Last modified: 17 November 2024

SHIPSHAPE is malware developed by APT30 that allows propagation and exfiltration of data over removable devices. APT30 may use this capability to exfiltrate data across air-gaps. [1]

TechniquesBottom 12%

Tactics32nd pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

SHIPSHAPE MITRE reference S0028

Replication Through Removable Media T1091 ↗

APT30 may have used the SHIPSHAPE malware to move onto air-gapped networks. SHIPSHAPE targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.2

Initial Access · Lateral Movement5 detection rules

Registry Run Keys / Startup Folder T1547.001 ↗

SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.3

Persistence · Privilege Escalation46 detection rules

Shortcut Modification T1547.009 ↗

SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.4

Persistence · Privilege Escalation4 detection rules

Standing S0028

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques3Bottom 12%

12th percentile · 88% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics432nd pct

32nd percentile · 68% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique5medBottom 7%

7th percentile · 93% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique2med

SHIPSHAPE detections S0028

55 distinct rules cover the 3 techniques recorded for this malware. 45 Sigma · 10 Splunk.

3 covered by at least one rule55 distinct rules in total

Showing 1-50 of 55 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects modification of Windows Registry Classes keys used for persistence. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	9df5f547-c86a-433e-b533-f2794357e242
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name)	2019-10-25	2025-10-22	f59c3faf-50f3-464b-9f4c-1b67ab512d99
	Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Shortcut Modification	-	high	frack113	2021-12-30	—	8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	f674e36a-4b91-431e-8aef-f8a96c2aca35
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	20f0ee37-5942-4e45-b7d5-c5b5db9df5cd
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	cbf93e5d-ca6c-4722-8bea-e9119007c248
	Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Shortcut Modification	-	medium	Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO)	2020-03-19	2025-12-09	81315b50-6b60-4d8f-9928-3466e1022515
	Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)	2019-10-25	2026-01-05	24357373-078f-44ed-9ac4-6d334a668a11
	Detects external disk drives or plugged-in USB devices.	Generic	test	-	windows	WinEventLog Security	Initial Access Hardware Additions Initial Access, Lateral Movement Replication Through Removable Media	-	low	Keith Wright	2019-11-20	2024-02-09	f69a87ea-955e-4fb4-adb2-bb9fd6685632
	Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of e (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-30190	high	Vadim Varganov, Florian Roth (Nextron Systems)	2022-08-24	2023-02-23	318557a5-150c-4c8d-b70e-a9910e199857
	Detects the setting of a custom protocol handler with the name "rogue". (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-38028	high	Nasreddine Bencherchali (Nextron Systems)	2024-04-23	—	5cdeb555-65de-4767-99fe-e26807465148
	Detects the setting of the DLL that handles the custom protocol handler. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-38028	high	Nasreddine Bencherchali (Nextron Systems)	2024-04-23	—	d807056b-0e00-4cec-b7f8-b8b7518e382b
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	a80f662f-022f-4429-9b8c-b1a41aaa6688
	Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Swachchhanda Shrawan Poudel	2024-07-03	—	c0c67b21-eb8a-4c84-a395-40473ec3b482
	Detects registry key used by Leviathan APT in Malaysian focused campaign	Emerging	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	critical	Aidan Bracher	2020-07-07	2023-09-19	70d43542-cd2d-483c-8f30-f16b436fd7db
	Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	frack113, Swachchhanda Shrawan Poudel (Nextron Systems)	2022-10-01	2026-01-05	9c226817-8dc9-46c2-a58d-66655aafd7dc
	Detects abusing Windows 10 Narrator's Feedback-Hub	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Dmitriy Lifanov, oscd.community	2019-10-25	2022-03-26	f663a6d9-9d1b-49b8-b2b1-0637914d199a
	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Shortcut Modification	-	medium	frack113, Nasreddine Bencherchali (Nextron Systems)	2021-12-29	2023-12-06	ee63c85c-6d51-4d12-ad09-04e25877a947
	Detects suspicious new RUN key element pointing to an executable in a suspicious folder	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems)	2018-08-25	2025-10-06	02ee49e2-e294-4d0f-9278-f5b3212fc588
	Detects modification of autostart extensibility point (ASEP) in registry. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2026-08-28	baecf8fb-edbf-429f-9ade-31fc3f22b970
	Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Nasreddine Bencherchali (Nextron Systems), X__Junior	2024-03-22	—	c9b86500-1ec2-4de6-9120-d744c8fb5caf
	Detects suspicious command line reg.exe tool adding key to RUN key in Registry	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)	2021-06-28	2025-02-17	de587dce-915e-4218-aac4-835ca6af6f70
	Detects Ryuk ransomware activity	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems)	2019-12-16	2023-02-03	c37510b8-2107-4b78-aa32-72f251e7a844
	Detects PowerShell writing startup shortcuts. (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Christopher Peacock '@securepeacock', SCYTHE	2021-10-24	2023-02-23	92fa78e7-4d39-45f1-91a3-8b23f3f1088d
	Detects potential suspicious behaviour using secedit.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access, Collection Adversary-in-the-Middle Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Authentication Package Port Monitors Active Setup Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Privilege Escalation Event Triggered Execution Netsh Helper DLL Accessibility Features Stealth Hide Artifacts Hidden Users Execution, Stealth Hijack Execution Flow Path Interception by PATH Environment Variable Persistence, Defense Impairment, Credential Access Modify Authentication Process Password Filter DLL Persistence Server Software Component Terminal Services DLL Discovery System Information Discovery	-	medium	Janantha Marasinghe	2022-11-18	2022-12-30	c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
Splunk	The following analytic identifies modifications to registry keys commonly used for persistence mechanisms. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk	2020-04-29	2026-10-09	f5f6af30-7aa7-4295-bfe9-07fe87c01a4b
	Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspic (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems), oscd.community	2018-07-18	2023-12-11	b7916c2a-fa2f-4795-9477-32b731f70f11
	Detects the setting of a registry inside the "\Shell\Open\Command" value with PowerShell classes from the "System.Security.Cryptography" namespace. (...)	Hunting	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information Command Obfuscation	-	medium	Andreas Braathen (mnemonic.io)	2023-12-01	—	1c2a3268-3881-414a-80af-a5b313b14c0e
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Persistence, Privilege Escalation Event Triggered Execution AppCert DLLs	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	046218bd-e0d8-4113-a3c3-895a12b2b298
	Detects Silence downloader. (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Discovery Process Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery	-	high	Alina Stepchenkova, Roman Rezvukhin, Group-IB, oscd.community	2019-11-01	2023-02-24	170901d1-de11-4de7-bccb-8fa13678d857	-
	A General detection for files being created in the Windows startup directory. (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2025-12-03	2aa0a6b4-a865-495b-ab51-c28249537b75
	Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Execution Windows Management Instrumentation	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-02-17	—	c80e66d8-1780-48a9-b412-46663fd21ac0
	Detects potential PowerShell commands or code within registry run keys	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	frack113, Florian Roth (Nextron Systems)	2022-03-17	2025-07-18	8d85cf08-bf97-4260-ba49-986a2a65129c
	Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Interne (...)	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems)	2019-10-01	2025-02-17	9c5037d1-c568-49b3-88c7-9846a5bdc2be
	Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Execution User Execution Malicious File	-	high	Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)	2022-08-10	2025-10-12	28208707-fe31-437f-9a7f-4b1108b94d2e
	Detects suspicious inline VBScript keywords as used by UNC2452	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems)	2021-03-05	2022-10-09	20c3f09d-c53d-4e85-8b74-6aa50e2f1b61
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1
	Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Persistence, Defense Impairment Modify Registry	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-01-05	—	8f3ab69a-aa22-4943-aa58-e0a52fdf6818
	Detects VBScript content stored into registry keys as seen being used by UNC2452 group	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems)	2021-03-05	2023-08-17	46490193-1b22-4c29-bdd6-5bf63907216f
Splunk	The following analytic detects the creation of files in the Windows %startup% folder, a common persistence technique. (...)	Anomaly	stable	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Teoderick Contreras, Splunk	2023-01-16	2026-07-20	99d157cb-923f-4a00-aee9-1f385412146f
	Detects changes to the Windows EventLog channel permission values. (...)	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Persistence, Defense Impairment Modify Registry	-	high	X__Junior	2025-01-16	2025-08-16	ba226dcf-d390-4642-b9af-b534872f1156
	Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. (...)	Generic	test	network_connection	windows	WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Shortcut Modification	-	medium	Tim Shelton (HAWK.IO)	2021-12-06	2022-01-16	35bc7e28-ee6b-492f-ab04-da58fcf6402e
Splunk	Detects the initial agent or persistent agent processes for Northstar C2 being run. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Resource Development Stage Capabilities Execution User Execution Malicious File	-	medium	Raven Tait, Splunk	2021-06-23	2026-05-13	5f13d5b2-5181-487b-89eb-e2b471522202
Splunk	The following analytic detects the execution of PowerShell commands to install unsigned AppX packages using Add-AppxPackage or Add-AppPackage cmdlets with the -AllowUnsigned flag. (...)	Generic	stable	ps_script	windows	PowerShell	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Execution Command and Scripting Interpreter PowerShell	-	medium	Michael Haag, Splunk	2025-08-18	2026-05-13	d2f77901-dbfa-42d9-8af7-dcd0f1a50a2f
Splunk	This analytic is used to identify when a removable media device is attached to a machine and then a process is executed from the same drive letter assigned to the removable media device. (...)	Anomaly	stable	process_creation	windows	Sysmon	Collection Data from Removable Media Initial Access Hardware Additions Initial Access, Lateral Movement Replication Through Removable Media	-	medium	Steven Dick	2025-01-17	2026-05-13	b483804a-4cc0-49a4-9f00-ac29ba844d08
Splunk	The following analytic detects modifications to the BootExecute registry key, which manages applications and services executed during system boot. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Persistence, Stealth Pre-OS Boot	CVE-2022-21894	medium	Michael Haag, Teoderick Contreras, Splunk	2023-05-11	2026-10-02	eabbac3a-45aa-4659-920f-6b8cff383fb8
Splunk	The following analytic identifies modifications to the SafeBoot registry keys, specifically within the Minimal and Network paths. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Teoderick Contreras, Michael Haag, Splunk	2022-03-31	2026-10-02	c6149154-c9d8-11eb-9da7-acde48001122
Splunk	The following analytic detects the creation or dropping of executable or script files in the root directory of a removable drive. (...)	Generic	stable	file_event	windows	Sysmon	Initial Access, Lateral Movement Replication Through Removable Media	-	medium	Teoderick Contreras, Splunk	2023-01-18	2026-05-13	60df805d-4605-41c8-bbba-57baa6a4eb97
Splunk	This analytic is used to identify when a USB removable media device is attached to a Windows host. (...)	Anomaly	stable	registry_event	windows	Sysmon	Collection Data from Removable Media Initial Access Hardware Additions Initial Access, Lateral Movement Replication Through Removable Media	-	medium	Steven Dick	2025-01-17	2026-05-13	a345980a-417d-4ed3-9fb4-cac30c9405a0
Splunk	This analytic is used to identify when a USB removable media device is attached to a Windows host. (...)	Anomaly	stable	registry_event	windows	Sysmon	Collection Data from Removable Media Initial Access Hardware Additions Initial Access, Lateral Movement Replication Through Removable Media	-	medium	Steven Dick	2025-01-17	2026-05-13	52b48e8b-eb6e-48b0-b8f1-73273f6b134e