Monitor for newly constructed drive letters or mount points to removable media. Monitor for newly executed processes that execute from removable media after it is mounted or when initiated by a user.
| Data Component | Name | Channel |
|---|---|---|
| Drive Creation (DC0042) | Drive | None |
| Process Creation (DC0032) | Process | None |