Plan
active
Windows PnP USB Emulation Chained to SYSTEM Privilege Escalation on Win11
- Engineer — Plan: The RDP USB-redirection vector means physical access is not required, making this relevant to any enterprise RDP deployment on Windows 11. No patch or KEV yet, but audit Group Policy now to restrict or disable PnP/USB redirection over Remote Desktop where it isn’t operationally required.
- SOC/IR — Plan: No IOCs or active exploitation are confirmed, but the technique produces detectable PnP driver installation events tied to RDP sessions; queue a detection rule for unexpected signed-driver installs initiated from RDP-redirected device paths as a hunting lead.
- Leader — Learn: Research-stage local privilege escalation against fully patched Windows 11; no active exploitation or regulatory trigger yet — file for awareness and revisit if Microsoft issues a patch or exploitation reports emerge.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.