Tag
medium
advisory
Suspicious Execution from a Mounted Device
2 rules 9 TTPsAttackers may use mounted devices as a non-standard working directory to execute signed binaries or script interpreters, evading traditional defense mechanisms, particularly when launched via explorer.exe.
Windows
defense-evasion
execution
mounted-device
2r
9t
high
advisory
Suspicious Execution from Mounted Device
3 rules 2 TTPsThis threat brief covers the detection of suspicious executables running from mounted devices, a common tactic used for defense evasion and malware deployment.
Windows Operating System
defense-evasion
execution
mounted-device
3r
2t