T1674No distinct observable

Input Injection

ExecutionWindows, macOS, Linux

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

What makes this technique itself is that the keystrokes are synthetic, and no log source in the brief records how input arrived — each one records only the process or script that resulted, which is byte-for-byte what the same command typed by the user produces. All three analytics therefore put the discriminator in a correlation MITRE names in its own knobs: AN1567's ExecutionTimeWindow, AN1568's ScriptExecutionThreshold ('less than 10 seconds') and AN1569's TimeWindow all mean 'HID device arrival followed closely by script execution'. lib/sigma models no timeframe, no aggregation and no cross-event correlation, so the pair collapses to one half or the other, and neither half is a detection of this technique. […]

Covered instead by T1059.001, T1564.003, T1091, T1200.

What the technique is

Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs). For example, adversaries have used tooling that monitors the Windows message loop to detect when a user visits bank-specific URLs. If detected, the tool then simulates keystrokes to open the developer console or select the address bar, pastes malicious JavaScript from the clipboard, and executes it - enabling manipulation of content within the browser, such as replacing bank account numbers during transactions. Adversaries have also used malicious USB devices to emulate keystrokes that launch PowerShell, leading to the download and execution of malware from adversary-controlled servers.

Read it on attack.mitre.org

What MITRE says you would watch

AN1567
Detects suspicious USB HID device enumeration and keystroke injection patterns, such as rapid sequences of input with no user context, scripts executed through simulated keystrokes, or rogue devices presenting themselves as keyboards.
AN1568
Detects USB HID device enumeration under /sys/bus/usb/devices/ and rapid keystroke injection resulting in command execution such as bash or Python scripts launched without interactive user activity.
AN1569
Detects abnormal HID device enumeration via I/O Registry (ioreg -p IOUSB) and keystroke injection targeting AppleScript, osascript, or PowerShell equivalents. Defender correlates new USB device connections with rapid script execution.