Windows Mustang Panda USB Tool Execution — Detection Rule
Detects known executables used for infection or DLL side loading by Mustang Panda being launched from a non-C:\ location. This can indicate a compromise via USB, or external storage device. You will have to adapt this detection if you do not use C:\ as the root device.