Wiki › Techniques, Tactics & Procedures (TTPs) › Initial Access › USB-Based Initial Access

USB-Based Initial Access

2 min read

Jump to:

Overview

USB-Based Initial Access is a technique where adversaries leverage removable USB storage devices to gain unauthorized entry into a target environment. This method is often used during the initial access phase of an attack lifecycle, exploiting physical proximity or social engineering to introduce malicious payloads. Adversaries favor this technique due to its ability to bypass network-based defenses and deliver malware directly to endpoints.

Attack Objective

Establish initial foothold within a target network or system
Supports the Initial Access and Execution stages of the attack lifecycle
Advances attacker position by enabling code execution and subsequent lateral movement or persistence

How the Technique Works

Attackers deliver malicious code or exploit payloads via USB devices, which are then physically connected to a target system. Upon insertion, the device may execute autorun scripts, exploit vulnerabilities in the host, or rely on user interaction to launch malware. This direct hardware interface circumvents many traditional network security controls, allowing adversaries to deploy payloads that establish a presence on the compromised host.

Common Methods & Variations

Use of infected USB drives containing malware, exploit kits, or payload droppers
Deployment of malicious Human Interface Device (HID) devices emulating keyboards to execute commands
Variants include on-premises endpoint targeting and scenarios involving cloud-connected devices
Use of living-off-the-land binaries and scripts pre-installed on the host to reduce detection

Indicators of Compromise (IOCs)

Unusual USB device connection logs or events on endpoints
Detection of autorun or script execution triggered by USB insertion
Presence of unknown or unauthorized removable storage devices
Unexpected process creation or command execution following USB device connection

Detection Strategies

Monitoring endpoint logs for USB device insertions and associated process executions
Behavioral detection focusing on anomalous command sequences or script activity post USB connection
Correlation of physical access logs with endpoint security telemetry

Mitigation & Prevention

Implement device control policies restricting or blocking unauthorized USB devices
Disable autorun and autoplay features on endpoints
Enforce least privilege and user awareness training to reduce risk of manual execution
Use endpoint security solutions with USB device monitoring and control capabilities

Response Considerations

Immediate isolation of affected systems upon detection of unauthorized USB usage
Conduct forensic analysis of USB device artifacts and endpoint activity
Review physical security controls and access logs to identify potential vectors
Apply patches and hardening measures to prevent re-exploitation

Related Techniques

Execution via Malicious Scripts or Payloads
Persistence through Scheduled Tasks or Services
Lateral Movement using Remote Services or Credential Access

Mapping & References

MITRE ATT&CK Tactic: Initial Access
MITRE ATT&CK Technique: T1204 – User Execution; T1091 – Replication Through Removable Media
Public advisories on USB-based attacks from cybersecurity organizations and incident reports

Tags: Attack Lifecycle Cybersecurity Defense endpoint security Execution Initial Access Malware Delivery MITRE ATT&CK removable media Threat Detection