PHL-T-002

Category: hid-injection
Severity: 8.0 / 10
Physical access: touch
Time to execute: 3 s
Skill level: 2 / 5
Hardware: RubberDuckyO.MG CableFlipper Zero BadUSB
MITRE ATT&CK: T1200T1059.001
MITRE D3FEND: D3-PSA

Observable indicators

cmd.exe / powershell.exe spawned with no parent UI focus
Burst typing speed >80 keystrokes/sec sustained
USB device enumeration of HID class on locked workstations

HID injection via BadUSB

A device emulating a USB HID keyboard injects keystrokes at machine speed. Bypasses USB mass-storage controls because the OS sees a keyboard.

Defensive layers

Detection: typing-rate anomaly via Sysmon Event ID 1 + endpoint telemetry. See phlipped-rules/PHL-D-002.
Prevent: USB lockdown via GPO restricting HID class on locked sessions; physical port blockers on kiosks.
Respond: isolate endpoint, review last 60s of process tree, revoke any credentials potentially touched.