Windows WPDBusEnum Registry Key Modification

This analytic is used to identify when a USB removable media device is attached to a Windows host. It queries the Endpoint Registry data model to look for modifications to the Windows Portable Device keys HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.