Add MountPointManagerAccess signature for drive discovery

[kevross33]

8ed4d1a368ada7db7c22b472c357c9401a445c1155f8f455d209759df1f9884f

[gemini-code-assist]

Code Review

This pull request introduces a new signature class MountPointManagerAccess to detect repeated access to the MountPointManager device, which is common in ransomware, wipers, and discovery activities. The review feedback highlights a potential AttributeError if the process parameter is None when retrieving the process ID, and suggests adding a defensive check.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.