macOS Hardware Addition via USB Devices
Hunts for unwarranted hardware additions through USB device connections in macOS Unified Logs. In an environment where USB devices are not permitted. In the absence of system.log, which used to show USB entries in previous macOS versions, this rule attempts to watch for this activity.
Sigma
