Techniques › T1674
T1674 Input Injection
execution — Windows, macOS, Linux · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1674
0
KEV CVEs mapped here
<p>Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs).</p><p>For example, adversaries have used tooling that monitors the Windows message loop to detect when a user visits bank-specific URLs. If detected, the tool then simulates keystrokes to open the developer console or select the address bar, pastes malicious JavaScript from the clipboard, and executes it - enabling manipulation of content within the browser, such as replacing bank account numbers during transactions.</p><p>Adversaries have also used malicious USB devices to emulate keystrokes that launch PowerShell, leading to the download and execution of malware from adversary-controlled servers.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0568 Detection Strategy for Input Injection v1.0
AN1567 WindowsDetects suspicious USB HID device enumeration and keystroke injection patterns, such as rapid sequences of input with no user context, scripts executed through simulated keystrokes, or rogue devices presenting themselves as keyboards.Tunable:
AuthorizedUSBDevicesExecutionTimeWindowParentProcessWhitelistAN1568 LinuxDetects USB HID device enumeration under/sys/bus/usb/devices/and rapid keystroke injection resulting in command execution such as bash or Python scripts launched without interactive user activity.auditd:SYSCALLexecve: parent process is usb/hid device handler, child process bash/python invoked→ DC0032 Process Creationlinux:syslogNew HID device enumeration with type 'keyboard' followed by immediate input injection→ DC0042 Drive CreationTunable:USBVendorIDsScriptExecutionThresholdAN1569 macOSDetects abnormal HID device enumeration via I/O Registry (ioreg -p IOUSB) and keystroke injection targeting AppleScript, osascript, or PowerShell equivalents. Defender correlates new USB device connections with rapid script execution.macos:unifiedlogNew IOUSB keyboard/HID device enumerated with suspicious attributes→ DC0042 Drive Creationmacos:unifiedlogosascript, AppleScript, or Python execution triggered immediately after HID connection→ DC0029 Script ExecutionTunable:AllowedAppleScriptsTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1674
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.