CCFH-202B: CrowdStrike Certified Falcon Hunter

RemovableMediaVolumeMounted is the event that specifically captures removable-media mount activity. Returning the timestamp, computer name, drive letter, filesystem device, and filesystem driver provides the relevant details for identifying USB storage usage. CQL supports filtering events and passing results through a pipe to format selected fields with table().