Fake USB Devices Exploit Windows Plug and Play for SYSTEM-Level Privilege Escalation
The 'Plug and Pwn' attack abuses Windows' built-in Plug and Play mechanism, which automatically installs vendor-signed driver packages — some of which contain exploitable components — without sufficient privilege controls. Because Windows trusts signed packages implicitly, attackers can emulate USB devices or leverage RDP to trigger installations that escalate privileges to SYSTEM level, requiring little to no user interaction. This matters because SYSTEM access represents the highest privilege tier on a Windows host, enabling full compromise without ever exploiting a traditional vulnerability in Windows itself. The attack highlights how trusted automation features and implicit trust in signed software can become a significant attack surface when not properly governed.
Tactical Insight
Immediate actions
- Audit and restrict which USB device classes are permitted to auto-install via Group Policy (e.g., `USBSTOR`, HID, network adapters).
- Disable or restrict Plug and Play driver installation for non-administrator users using the `Prevent installation of devices not described by other policy settings` GPO.
- Block inbound RDP from untrusted networks at the perimeter firewall to reduce remote exploitation vectors.
Long-term improvements
- Implement an allowlist of approved, vetted driver packages and enforce it through Windows Defender Application Control (WDAC) or AppLocker policies.
- Regularly audit third-party vendor software bundled with signed driver packages for known vulnerable components.
- Apply the principle of least privilege so that even if Plug and Play triggers an install, the process cannot escalate to SYSTEM without additional controls.
Detection measures
- Monitor Windows Event Logs (Event IDs 20001, 20003, 7045) for unexpected driver and service installations, especially outside of change windows.
- Deploy endpoint detection tools that alert on new services or processes spawning at SYSTEM privilege from device installation paths.
- Implement USB device inventory and anomaly detection to flag emulated or unexpected device identifiers on endpoints.