Limitations
Take into consideration that VendorID and ProductID can be spoofed natively by the Rubber Ducky.
The following IDs are the default ones.
Device Instance Path
Using ATTACKMODE HID
:
HID\VID_03EB&PID_2401&REV_0100
Using ATTACKMODE HID STORAGE
:
HID\VID_03EB&PID_2422&REV_0100
VendorID
03EB
ProductID
Using ATTACKMODE HID
:
2401
Using ATTACKMODE HID STORAGE
:
2422
Class
HID
Author
@enesilhaydin
@_ezlucky_
Sigma/Yara Rules
Coming Soon…