BadUSB HID injection PowerShell via Windows Run dialog

Hunt Hypothesis

Adversaries may use BadUSB HID injection to execute PowerShell via the Windows Run dialog, leveraging T1059.001 and T1564.003 to evade detection and establish persistence. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential USB-based attacks that bypass traditional endpoint defenses.

KQL Query

let timeframe = 1d;
let EvasionFlags = dynamic([
    "-NoProfile",
    "-NonInteractive",
    "-EncodedCommand",
    "DownloadString",
    "IEX",
    "Invoke-Expression",
    "WebClient",
    "Start-Process"
]);
DeviceProcessEvents
| where TimeGenerated >= ago(timeframe)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where InitiatingProcessFileName =~ "explorer.exe"
| where ProcessCommandLine has_all ("-WindowStyle", "Hidden")
| where ProcessCommandLine has_any (EvasionFlags)
    or ProcessCommandLine has_all ("-ExecutionPolicy", "Bypass")
| extend AccountCustomEntity = AccountName
| extend HostCustomEntity    = DeviceName
| project
    TimeGenerated,
    DeviceName,
    HostCustomEntity,
    AccountName,
    AccountCustomEntity,
    AccountDomain,
    ProcessCommandLine,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    ReportId
| sort by TimeGenerated desc

Analytic Rule Definition

id: 683b2baa-39c3-457d-b64e-2e57c8fc83ba
name: BadUSB HID injection PowerShell via Windows Run dialog
description: |
  Identifies PowerShell spawned by explorer.exe with a hidden window and a
  remote-execution or evasion flag. Consistent with BadUSB HID injection opening
  the Windows Run dialog via WIN+R; the explorer.exe parent is the keystroke-
  injection signal.
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceProcessEvents
tactics:
  - Execution
  - DefenseEvasion
  - InitialAccess
relevantTechniques:
  - T1059.001
  - T1564.003
  - T1200
query: |
  let timeframe = 1d;
  let EvasionFlags = dynamic([
      "-NoProfile",
      "-NonInteractive",
      "-EncodedCommand",
      "DownloadString",
      "IEX",
      "Invoke-Expression",
      "WebClient",
      "Start-Process"
  ]);
  DeviceProcessEvents
  | where TimeGenerated >= ago(timeframe)
  | where FileName in~ ("powershell.exe", "pwsh.exe")
  | where InitiatingProcessFileName =~ "explorer.exe"
  | where ProcessCommandLine has_all ("-WindowStyle", "Hidden")
  | where ProcessCommandLine has_any (EvasionFlags)
      or ProcessCommandLine has_all ("-ExecutionPolicy", "Bypass")
  | extend AccountCustomEntity = AccountName
  | extend HostCustomEntity    = DeviceName
  | project
      TimeGenerated,
      DeviceName,
      HostCustomEntity,
      AccountName,
      AccountCustomEntity,
      AccountDomain,
      ProcessCommandLine,
      InitiatingProcessFileName,
      InitiatingProcessCommandLine,
      ReportId
  | sort by TimeGenerated desc
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
      - identifier: NTDomain
        columnName: AccountDomain
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostCustomEntity
version: 1.0.0
metadata:
    source:
        kind: Community
    author:
        name: descambiado
    support:
        tier: Community
    categories:
        domains: [ "Security - Threat Protection" ]

Required Data Sources

MITRE ATT&CK Context

• Tactic: Execution
• Tactic: DefenseEvasion
• Tactic: InitialAccess
• Technique: T1059.001 — PowerShell
• Technique: T1564.003 — T1564.003
• Technique: T1200 — T1200

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/DeviceProcess/BadUSBPowerShellRunDialog.yaml)

False Positive Guidance

• Scenario: Legitimate Scheduled Job Execution
  Description: A scheduled task runs a PowerShell script via the Run dialog to perform routine system maintenance.
  Filter/Exclusion: ProcessCommandLine NOT LIKE '%schtasks%' OR ProcessCommandLine NOT LIKE '%powershell.exe -Command%'

• Scenario: Admin Performing Remote Execution via Run Dialog
  Description: An administrator uses the Run dialog to execute a remote PowerShell script for remote management or patching.
  Filter/Exclusion: UserAccountControlLevel = 'Admin' AND ProcessCommandLine LIKE '%-Command %' OR ProcessCommandLine LIKE '%Invoke-Command%'

• Scenario: PowerShell Script for System Monitoring
  Description: A monitoring tool (e.g., SolarWinds, Nagios) uses PowerShell via the Run dialog to collect system metrics.
  Filter/Exclusion: ProcessCommandLine LIKE '%SolarWinds%' OR ProcessCommandLine LIKE '%Nagios%' OR ProcessCommandLine LIKE '%Get-Counter%'

• Scenario: User Launching PowerShell for File Operations
  Description: A user opens PowerShell via Run dialog to move or copy files using Move-Item or Copy-Item.
  Filter/Exclusion: ProcessCommandLine LIKE '%Move-Item%' OR ProcessCommandLine LIKE '%Copy-Item%' OR ProcessCommandLine LIKE '%-File%'

• Scenario: PowerShell Script for Software Deployment
  Description: A deployment tool (e.g., Microsoft Endpoint Configuration Manager) uses PowerShell via Run dialog to install software.
  Filter/Exclusion: ProcessCommandLine LIKE '%msiexec%' OR ProcessCommandLine LIKE '%Deploy%' OR ProcessCommandLine LIKE '%-File %'