AN1567
Analytic 1567
Windows
Detects suspicious USB HID device enumeration and keystroke injection patterns, such as rapid sequences of input with no user context, scripts executed through simulated keystrokes, or rogue devices presenting themselves as keyboards.
WinEventLog:System
EventCode=2003
WinEventLog:Security
EventCode=4688
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
[AuthorizedUSBDevices]
List of known, legitimate USB vendor/product IDs authorized for use in the enterprise.
[ExecutionTimeWindow]
Restrict detection to times when no user is logged in or activity is outside business hours.
[ParentProcessWhitelist]
List of legitimate parent processes expected to spawn PowerShell or scripting engines.
AN1568
Analytic 1568
Linux
Detects USB HID device enumeration under `/sys/bus/usb/devices/` and rapid keystroke injection resulting in command execution such as bash or Python scripts launched without interactive user activity.
auditd:SYSCALL
execve: parent process is usb/hid device handler, child process bash/python invoked
linux:syslog
New HID device enumeration with type 'keyboard' followed by immediate input injection
[USBVendorIDs]
Track suspicious or unapproved USB vendor/product IDs.
[ScriptExecutionThreshold]
Time threshold for script execution after HID injection, e.g., less than 10 seconds.
AN1569
Analytic 1569
macOS
Detects abnormal HID device enumeration via I/O Registry (ioreg -p IOUSB) and keystroke injection targeting AppleScript, osascript, or PowerShell equivalents. Defender correlates new USB device connections with rapid script execution.
macos:unifiedlog
New IOUSB keyboard/HID device enumerated with suspicious attributes
macos:unifiedlog
osascript, AppleScript, or Python execution triggered immediately after HID connection
[AllowedAppleScripts]
Whitelist of AppleScripts expected in the environment, to minimize false positives.
[TimeWindow]
Timeframe between HID injection and script execution considered suspicious.