USB mass storage connection followed by bulk file copy to removable media
Detects when a USB mass storage device is connected to a host and is followed shortly thereafter by a large volume of file creations or modifications on a removable drive, which may indicate data exfiltration or staging.
Microsoft Sentinel (KQL)
