AV Detections with USB Disk Drive
This query make a best-guess detection regarding which removable media device caused an AV detection. The query is best run over 30 days to get the full USB history. Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device.
Microsoft Sentinel (KQL)
