How can I attach the filter to a USB drive?

If the filter driver is installed on the system, it will automatically attach itself the BeforeFilterAttachToVolume event handler instructs it to skip the drive. That said, if you use drive-specific filter rules (i.e., those that include device names), you'll need to add and remove such rules as USB drives are inserted and removed. This should be done during the AfterFilterAttachToVolume and AfterFilterDetachFromVolume events.