Living Off The Hardware is a resource collection that helps you identify and understand malicious hardware and attack capable devices. Definitions for these devices are shared below, and you can use them to create blocking rules in your AV and EDR security solutions. Each device comes with sample usage and a list of its identifiers.
Please note that the values listed are the default ones, and an attacker can change these IDs if they want to. Completely preventing malicious USB devices is not always feasible, since IDs can be spoofed, so treat these values as indicators rather than guarantees.
Want to contribute? To add a device, open a pull request on GitHub. To request a device or report an error, open an issue or email [email protected].
You can download the JSON version of the project from this link
