Skip to content
attack.paths
Anmelden
← RegistryDossier · 6 steps · 5 edges

USB drop in parking lot → HID payload → C2

Drop branded-looking USB sticks near the target site. An employee plugs one in; a Rubber-Ducky-class HID device types a PowerShell payload that connects out to attacker C2.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target has employees in / out of the building, USB ports unrestricted on workstations (no Device Control / EDR USB block). Outbound HTTPS to commodity hosts allowed.

§ Steps

  1. 01
    PowerShell stager runsExecution
    T1059— Command and Scripting Interpreter
  2. 02
    Beacon to attacker C2Command and Control
    T1071— Application Layer Protocol
  3. 03
    Curious employee plugs inExecution
    T1204— User Execution
  4. 04
    Local persistence on workstationPersistence
    W-SCHEDTASK-HIJACK— Scheduled Task Hijack
  5. 05
    Drop sticks in parking lot / lobbyInitial Access
    SE-PRETEXT— Pretexting
  6. 06
    Build HID payload (Ducky Script)Initial Access
    SE-USB-DROP— USB Drop / HID Attack

§ References

§ Frequently asked

What is the "USB drop in parking lot → HID payload → C2" attack path?
Drop branded-looking USB sticks near the target site. An employee plugs one in; a Rubber-Ducky-class HID device types a PowerShell payload that connects out to attacker C2. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is PowerShell stager runs (T1059) — a execution primitive. Assumed environment: target has employees in / out of the building, USB ports unrestricted on workstations (no Device Control / EDR USB block).
What is the final impact of this kill-chain?
The final step lands on Build HID payload (Ducky Script) (SE-USB-DROP), which falls under Initial Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers