USB Device Plugged/Unplugged Detection
This rule detects when a USB device is plugged in or unplugged by monitoring specific event IDs from the Microsoft-Windows-DriverFrameworks-UserMode/Operational event log. Event ID 2003 indicates driver loading, while Event IDs 2100 and 2102 relate to Plug and Play (PnP) or power management events, which are typically generated when a USB device is connected or disconnected.
Sigma
