Suspicious USB Device Connection Detected
This rule detects the connection of USB devices identified as suspicious based on a curated list of Vendor IDs (VIDs) and Product IDs (PIDs). It monitors 'PnpDeviceConnected' events, extracts VID and PID from the device information, and cross-references them with an external list of known suspicious USB device identifiers. The rule aims to identify potentially malicious or unauthorized USB devices being connected to endpoints.
Microsoft Sentinel (KQL)
