Techniques › T1674 › AN1568
AN1568 Analytic 1568
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects USB HID device enumeration under
/sys/bus/usb/devices/ and rapid keystroke injection resulting in command execution such as bash or Python scripts launched without interactive user activity.</p>- Detects
- T1674 Input Injection
- Part of
- DET0568 Detection Strategy for Input Injection
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve: parent process is usb/hid device handler, child process bash/python invoked | DC0032 Process Creation |
| linux:syslog | New HID device enumeration with type 'keyboard' followed by immediate input injection | DC0042 Drive Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
USBVendorIDs | Track suspicious or unapproved USB vendor/product IDs. |
ScriptExecutionThreshold | Time threshold for script execution after HID injection, e.g., less than 10 seconds. |