Detects attempts to spread malware through automatic execution when a USB device is connected, based on AhnLab EPP V3 malware alert logs.

Overview

Priority	Medium
Type	Stream
Log schema	ahnlab-epp-v3-malware
Message	안랩 EPP V3 USB 자동실행 악성코드 탐지: 호스트 $host_ip, 악성코드 $signature
Output field order	_log_time, hostname, host_ip, emp_name, dept_name, signature, file_path, file_status, md5
MITRE Techniques	T1091 Replication Through Removable Media
MITRE tactics	TA0001 Initial Access· TA0008 Lateral Movement

Query

The AhnLab V3 antivirus engine detects USB-propagated malware such as TextImage/Autorun when a USB device is connected. Alerts are extracted when the detected file path corresponds to an autorun.inf file located in the root of a drive.

Target logger models

• AhnLab EPP syslog

Threat analysis

• The autorun.inf file created on USB storage devices has traditionally been used for automatic execution and propagation of malware.
• Attackers may use an infected USB to automatically run malicious executables, enabling initial access or spreading malware laterally within an internal network.
• In older Windows environments where execution can occur without user interaction, infection can spread rapidly, making immediate action essential.

False positives

• Some legitimate USB devices or legacy software may include an autorun.inf file.
• However, modern security environments rarely rely on USB autorun functionality, so the likelihood of false positives is low.

Response actions

• Perform malware scans and file system checks on both the USB device and the connected endpoint.
• Because the USB may be infected, isolate the device and investigate other endpoints that may have used the same USB.
• Verify that USB autorun functionality is disabled through Group Policy (GPO) or EPP configurations.
• If necessary, strengthen USB storage usage policies and enable detection or blocking of unauthorized USB devices.