topic Protection against Hack5 tools incl. USB Rubber Ducky in Cortex XDR Discussions

Protection against Hack5 tools incl. USB Rubber Ducky

Cyber1985 — Mon, 10 Oct 2022 17:48:14 GMT

Hello dear community,

Has anyone of you expierience with usb rubber ducky and cortex xdr?

Our supplier couldn't answer this from the beginnen of the poc. (~1Y)

Maybe the collection of a community like you get this question faster answered?

I would like to know how cortex would stop it in a smart way.

Rob

Re: Protection against Hack5 tools incl. USB Rubber Ducky

mavraham — Tue, 11 Oct 2022 15:08:56 GMT

Hi Cyber1985,

By default, all external USB devices are allowed to connect to Cortex XDR endpoints. However, you can use Cortex XDR to manage and block devices connecting to an endpoint using Device Control.

After you apply Device Control rules in your environment, use the Endpoints -> Device Control Violations page to monitor all instances where end users attempted to connect restricted USB-connected devices and Cortex XDR blocked them on the endpoint.
I would also advise you to go through this thread, which discusses how to create custom device classes.

Last, Cortex XDR should also be able to detect Rubber Duckies and similar devices((depending on the payload being executed) through its BTP module.

Hope this helps!

Re: Protection against Hack5 tools incl. USB Rubber Ducky

Cyber1985 — Wed, 12 Oct 2022 20:29:56 GMT

From my expierience now on, it doesn't make sence to block HID Devices in cortex. Who does this? You would need to WL All the guids from All Keyboards in place.

An it would be the same for RD, because this is also just a HID usb device.

Rob