Tag
Detection rule identifies first-time seen USB storage devices mounted on Windows and macOS endpoints to help analysts monitor for potential initial access, lateral movement, or data exfiltration.