1. A non-transitory, tangible, computer readable medium comprising one or more instructions that, when executed on a processor, configure the processor to perform operations comprising: monitoring, by a security system, file copy or create operations directed to a removable storage device to detect an attempt by a program on a first device to store a configuration file and an executable file on the removable storage device; and, in response to detecting the attempt, displaying, by the security system, an alert including at least a part of text in the configuration file, wherein the part of the text in the configuration file identifies that the executable file is to be executed via the configuration file.