SE-USB-DROPInitial Access

USB Drop / HID Attack

Drop a Rubber-Ducky / Bash-Bunny / O.MG cable in a parking lot or break room — fires keystrokes / drops payload when plugged in.

§ Where this technique fits

SE-USB-DROP is catalogued under the Initial Access tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 1 on average.

§ Dossiers chaining this technique

USB drop in parking lot → HID payload → C2
Drop branded-looking USB sticks near the target site. An employee plugs one in; a Rubber-Ducky-class HID device types a PowerShell payload that connects out to attacker C2.
step 1 / 6

§ What commonly comes next

01
Pretexting
SE-PRETEXT · Initial Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

USB drop in parking lot → HID payload → C2

§ What commonly comes next