USB PnP Auto-Install Exploited for SYSTEM-Level Takeover on Windows 11
Attackers can abuse Windows 11's Plug and Play auto-installation mechanism by emulating specific USB devices, causing the OS to silently install legitimately signed vendor software with elevated privileges. Because the software is signed, it bypasses typical security checks, allowing attackers to chain the installation into arbitrary code execution at SYSTEM level. What makes this especially dangerous is its remote exploitability via RDP USB redirection, meaning physical access is not required. This attack highlights how trusted OS features and vendor-signed software can become attack vectors when combined with permissive default configurations. Organizations that allow unrestricted USB redirection in remote desktop environments are particularly exposed.
Tactical Insight
Immediate actions
- Disable USB redirection in Remote Desktop Session Host (RDSH) and RDP Group Policy settings unless explicitly required for business use.
- Restrict PnP device installation permissions via Group Policy to prevent non-administrative users from triggering driver or software installs.
- Audit and block unauthorized USB device classes using Windows Defender Device Control or equivalent endpoint tooling.
Long-term improvements
- Maintain a vetted allowlist of approved USB device classes and enforce it consistently across all endpoints and virtual desktop environments.
- Integrate USB device activity and PnP installation events into your SIEM for anomaly detection and alerting.
- Apply the principle of least privilege to ensure no auto-installed vendor software can execute with SYSTEM-level permissions without explicit approval.
Detection measures
- Monitor Windows Event Logs (Event IDs 20001, 20003) for unexpected PnP driver installation activity, especially from unusual device emulators.
- Alert on RDP sessions with USB redirection enabled, particularly from external or untrusted network segments.
- Conduct regular red team exercises targeting physical and remote USB attack vectors to validate defensive controls.