Files Copied to USB Drives - Enriched with Intune Device Control Identifiers
Detects files being written to USB-mounted removable drives. The rule enriches these alerts with USB device identifiers such as VID_PID, InstancePathId, and SerialNumberId, gathered from fleet-wide Plug and Play (PnP) events. This enrichment allows security analysts to cross-reference the detected USB devices against an organization's approved device exclusion list, potentially managed by solutions like Microsoft Intune, to differentiate legitimate data transfers from potential data exfiltration attempts.
Microsoft Sentinel (KQL)
