Rogue Network Device Keyboard Injection Pattern
This rule detects a pattern indicative of a rogue network device performing keyboard injection. It specifically looks for the case-insensitive string "HID" (Human Interface Device) within TCP traffic flowing from a client to a server, with a threshold of 3 occurrences within 5 seconds from the same source. This behavior is often associated with devices like USB Rubber Ducky or similar tools used for automated keystroke injection.
Suricata
