Update windows_detect_process_executed_from_removable_media.yml

Author: nterl0k

detections/endpoint/windows_detect_process_executed_from_removable_media.yml

@@ -1,11 +1,11 @@
-name: Windows Detect Process Executed From Removable Media
+name: Windows Process Executed From Removable Media
 id: b483804a-4cc0-49a4-9f00-ac29ba844d08
 version: 1
 date: '2025-01-17'
 author: Steven Dick
 status: production
 type: Anomaly
-description: This analytic is used to identify when a process is executed with a removable media device as it's current drive or run path. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
+description: This analytic is used to identify when a removable media device is attached to a machine and then a process is executed from the same drive letter assigned to the removable media device. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
 data_source: 
 - Windows Security Event ID 4688
 - Sysmon Event ID 1
@@ -24,8 +24,8 @@ search: |-
      | `drop_dm_object_name(Registry)`
      | eval object_handle = registry_value_data, object_name = replace(mvindex(split(mvindex(split(registry_path, "??"),1),"&"),2),"PROD_","")
     ]
-  | `windows_detect_process_executed_from_removable_media_filter`
-how_to_implement: To successfully implement this search, you must ingest endpoint logging that tracks changes to the HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ registry keys as well as Process Execution commands. Ensure that the field from the event logs is being mapped to the proper fields in the Endpoint.Registry data model.
+  | `windows_process_executed_from_removable_media_filter`
+how_to_implement: To successfully implement this search, you must ingest endpoint logging that tracks changes to the HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ registry keys as well as Process Execution commands. Ensure that the field from the event logs is being mapped to the proper fields in the Endpoint.Registry data model. This analytic joins the Process and Registry datamodels together based on the drive letter extract to the "object_handle" field from both datasets.
 known_false_positives: Legitimate USB activity will also be detected. Please verify and investigate as appropriate.
 references:
 - https://attack.mitre.org/techniques/T1200/