Get-USBHistory: get history of a USB flash driving using PowerShell

#DFIR tip:

You can mass query USB devices used across an enterprise by leveraging PowerShell.

Leverage this to hunt for malicious insiders. Keep historical records to detect anomalies.

1) https://t.co/k4g06z30QV

2) https://t.co/P8zUs18H3B

— Andrew Case (@attrc) February 9, 2018