Disabling of an Input Device

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the disabling of critical input devices such as keyboard and mouse, which may indicate malicious activity aimed at preventing user interaction with the system. Threat actors may disable input devices during attacks to maintain persistence and prevent users from interrupting malicious operations or accessing security tools. This technique is often observed in ransomware attacks and data exfiltration scenarios where attackers seek to minimize user interference. To verify if the disabling was legitimate or part of an attack, further investigation into the context and source of the action is recommended

2026-03-22 00:00:00

None

f7995cdf-9d41-43a8-8bd5-da438cdc6404

attack.defense-evasion attack.t1562.001 attack.impact

Nextron Sigma feed only (private)