Kiosk Malicious USB Peripheral incident response playbook · Cybersecurity Atlas
Kiosk Malicious USB Peripheral
HighKiosk SecurityN/A - Physical/Kiosk Security
An attacker connects a malicious USB device, such as a keystroke injector or rogue network adapter, to an unattended kiosk to execute commands, escape the kiosk shell, or capture traffic.
Immediate Response
1Take the kiosk offline and inspect it physically for attached devices.
2Reimage the kiosk from a known-good image.
3Rotate credentials or tokens stored on the device.
4Review logs for commands executed and data accessed during the incident.
