Plug and Pwn: Fake USB devices exploit Windows PnP for SYSTEM access

Thu, 13 Aug 2026 11:57:16 +0000

Engineer — Plan: No active exploitation or PoC pressure yet, but physical-access USB attacks leading to SYSTEM are a real hardening target — audit Group Policy and MDM settings to restrict unsigned driver installation and limit who can install devices on managed endpoints.
SOC/IR — Learn: No IOCs or active campaign to hunt; worth understanding the PnP abuse technique to anticipate detection opportunities (e.g., monitoring for unexpected driver installs or PnP device events on sensitive hosts) if exploitation becomes active.
Leader — Skip

Usb on CuraSec