USB Drive Mounted on Specific Device
This rule monitors for the mounting of USB drives on a specific device. It aims to detect unauthorized data exfiltration attempts, audit physical device access, investigate insider threats or policy violations, and track removable media usage for compliance purposes.
Microsoft Sentinel (KQL)
