29393f2ca4
* Revise USB device mounting detection rule Updated detection rule for USB device mounting to use device serial number instead of friendly name. Enhanced investigation steps and response actions for better clarity. * Update initial_access_exfiltration_new_usb_device_mounted.toml * Update rules/cross-platform/initial_access_exfiltration_new_usb_device_mounted.toml * Update initial_access_exfiltration_new_usb_device_mounted.toml --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>