HID Keystroke Injection Attack via USB Emulation

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects potential HID (Human Interface Device) keystroke injection attacks via USB emulation. It specifically looks for HTTP client body content containing both the terms 'keyboard' and 'inject' (case-insensitive). This pattern suggests an attempt to simulate keyboard input, often associated with devices like 'BadUSB' or 'Rubber Ducky' that emulate a keyboard to deliver malicious keystrokes.