T1674 — Input Injection

Tactic: Execution · Platforms: Windows, macOS, Linux

Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These…

Sigma detection rules (3)

T1674 Input Injection

title: T1674 Input Injection
id: b9a82b3c-d267-4425-aa65-0bcfe4805d17
description: 'Detection Strategy for Input Injection (T1674): flags a command interpreter (cmd.exe, powershell.exe, mshta.exe, wscript.exe/cscript.exe) spawned directly from a browser process, the process-creation signature of "ClickFix"-style attacks where simulated keystrokes (Win+R, Ctrl+V, Enter) or an injected script paste malicious commands into a Run dialog or developer console opened from the browser. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: AuthorizedUSBDevices, ExecutionTimeWindow, ParentProcessWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1674
author: Shahrukh Khan
date: 2026-03-04
license: MIT
tags:
  - attack.execution
  - attack.t1674

logsource:
  category: process_creation
  product: windows

detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\iexplore.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Browser extensions or enterprise tooling that legitimately launch a shell/script host as a child of the browser (rare); System and service accounts performing the same action are excluded via filter_system_account; tune ParentProcessWhitelist for known-good automation.

level: medium

T1674 Input Injection

title: T1674 Input Injection
id: 4e716a34-0cec-4e92-89e7-82fa866a3d56
description: 'Detection Strategy for Input Injection via Malicious HID Devices. auditd process-creation and file-event telemetry has no visibility into keystroke or HID emulation at all - the prior version detected a scripting interpreter pointed at a file on removable media, which is execution-from-removable-media (a different behavior, closer to T1091/T1200) rather than simulated keystroke input. Retargeted to the closest Linux-observable proxy: kernel-logged USB HID keyboard-device attach events (via journald/dmesg), which is how a BadUSB/Rubber-Ducky-style keystroke-injection implant first appears on the host, since it enumerates as a new HID keyboard. This cannot see the injected keystrokes themselves, only that a new HID input device was attached. Tune using: USBVendorIDs, KnownPeripheralAllowlist.'
references:
  - https://attack.mitre.org/techniques/T1674
author: Shahrukh Khan
date: 2026-02-20
license: MIT
tags:
  - attack.execution
  - attack.t1674

logsource:
  product: linux
  service: journald

detection:
  selection_hid_attach:
    Message|contains:
      - 'new low-speed USB device'
      - 'new full-speed USB device'
      - 'Keyboard'
      - 'input: '

  condition: selection_hid_attach

falsepositives:
  - Legitimate USB keyboards, KVM switches, and docking stations attaching or reconnecting generate the same kernel log lines; scope KnownPeripheralAllowlist to already-approved vendor/product ID strings, since raw auditd cannot itself provide USB descriptor data.

level: informational

T1674 Input Injection

title: T1674 Input Injection
id: b6f729a3-aa46-4556-a6f8-b9ab0a2cd205
description: 'Detection Strategy for Input Injection. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedAppleScripts, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1674
author: Shahrukh Khan
date: 2026-03-21
license: MIT
tags:
  - attack.execution
  - attack.t1674

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/osascript'
    CommandLine|contains|all:
      - 'System Events'
      - 'keystroke'

  condition: selection

falsepositives:
  - Accessibility automation tools and approved macro utilities that legitimately use System Events keystroke injection for assistive technology purposes.

level: high

Explore