External Plug and Play Device Connection
This rule detects the connection of external Plug and Play (PnP) devices, including USB storage, to a system. It identifies events where a USB drive is mounted or a generic PnP device is connected, extracting details such as vendor, product ID, and serial number for investigation.
Microsoft Sentinel (KQL)
