Removable media activity searches for file exfiltration
| Description |
|---|
| CD burning |
| DVD file writes |
| floppy disk activity |
| PCMCIA device activity |
| Removable media during off hours |
| removable media process starts |
| Serial port activity |
| USB file writes |
| VMware backdoor file activity |
| process execution from a USB drive |
| process execution from a DVD |