I'm not completely confident with this yet, so take it with a grain of salt and more research.
It starts with the kernel hotplug subsystem. After a device is setup, it either calls whatever userspace program is setup to handle hotplug events (if one was set by
echo hotplug_handler > /proc/sys/kernel/hotplug) or sends a data packet over the kobject_uevent netlink socket. When the kernel launches the hotplug handler, it sets up some environment variables. When the kernel sends a datapacket, it includes key=value pairs. If you want to, you can setup a script that just logs the environment and set it up as the handler (not on your production system, of course - a test setup).
Usually, udev is setup as the handler, and it will have several rules setup about how to handle events. From there, it can launch other programs that do other things (like issue dbus messages). These udev rules are highly dependent on the particular distribution of interest.
There is a lot of information in this thread where someone is trying to write some documentation - note the first message is not accurate; keep reading.