LoFP / t1091

t1091

Title	Tags
administrators may allow creation of script or exe in the paths specified. filter as needed.	t1036 t1091 endpoint splunk
legitimate usb activity will also be detected. please verify and investigate as appropriate.	T1025 t1091 t1200 endpoint splunk
likely	t1006 t1059 t1059.001 t1082 t1091 t1200 t1217 t1482 t1560 t1560.001 windows linux sigma