1 rule found for "Aaron Herman"
Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO.