Detection rules › By eventMicrosoft-Windows-Security-Auditing event 64161 detection rule reference this event. View event page.Sigma (1)External Disk Drive Or USB Storage Device Was Recognized By The System severity low T1091, T1200