Disable Input Devices via Disable-PnpDevice

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects usage of Disable-PnpDevice PowerShell cmdlet to disable crucial input devices such as keyboards and mouse. Adversaries may disable input devices to prevent user interaction with the system, facilitating further malicious activities without interruption. This technique can be part of a broader strategy to maintain persistence or evade detection by hindering user access.

2026-03-22 00:00:00

None

2b0670cc-0dba-43c7-a5dd-3ef8ea12597c

attack.defense-evasion attack.t1562.001 attack.impact

Nextron Sigma feed only (private)