FIN7G0046 ↗
Has used malicious USBs to emulate keystrokes to launch PowerShell to download and execute malware from the adversary's server.12
tfMITRE ATT&CK technique
Input Injection T1674
- Tactic
- Execution
- Platforms
- Windows, macOS, Linux
- Version
- 1.0
- Created
- 27 March 2025
- Last modified
- 15 April 2025
- Contributor
- Alexey Kleymenov
Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs).
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Input Injection MITRE reference T1674
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
Offense vs defense T1674
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Input Injection detection strategy DET0568
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Input Injection
3 platforms
AN1567 · Windows
Detects suspicious USB HID device enumeration and keystroke injection patterns, such as rapid sequences of input with no user context, scripts executed through simulated keystrokes, or rogue devices presenting themselves as keyboards.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Drive CreationDC0042 | WinEventLog:System | EventCode=2003 |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AuthorizedUSBDevices | List of known, legitimate USB vendor/product IDs authorized for use in the enterprise. |
| ExecutionTimeWindow | Restrict detection to times when no user is logged in or activity is outside business hours. |
| ParentProcessWhitelist | List of legitimate parent processes expected to spawn PowerShell or scripting engines. |
AN1568 · Linux
Detects USB HID device enumeration under /sys/bus/usb/devices/ and rapid keystroke injection resulting in command execution such as bash or Python scripts launched without interactive user activity.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve: parent process is usb/hid device handler, child process bash/python invoked |
| Drive CreationDC0042 | linux:syslog | New HID device enumeration with type 'keyboard' followed by immediate input injection |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| USBVendorIDs | Track suspicious or unapproved USB vendor/product IDs. |
| ScriptExecutionThreshold | Time threshold for script execution after HID injection, e.g., less than 10 seconds. |
AN1569 · macOS
Detects abnormal HID device enumeration via I/O Registry (ioreg -p IOUSB) and keystroke injection targeting AppleScript, osascript, or PowerShell equivalents. Defender correlates new USB device connections with rapid script execution.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Script ExecutionDC0029 | macos:unifiedlog | osascript, AppleScript, or Python execution triggered immediately after HID connection |
| Drive CreationDC0042 | macos:unifiedlog | New IOUSB keyboard/HID device enumerated with suspicious attributes |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedAppleScripts | Whitelist of AppleScripts expected in the environment, to minimize false positives. |
| TimeWindow | Timeframe between HID injection and script execution considered suspicious. |
Execution PreventionM1038
Denylist scripting and use application control where appropriate. For example, PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).
Limit the use of USB devices and removable media within a network.