Duck Hunt: Memory forensics of USB attack platforms

To explore the memory forensic artifacts generated by USB-based attack platforms, we analyzed two of most popular commercially available devices, Hak5's USB Rubber Ducky and Bash Bunny. We present open source Volatility plugins, usbhunt dhcphunt, which extract these attacks from Windows 10 system images. Such include driver-related diagnostic events, unique device identifiers, DHCP client logs. Our tools are capable extracting metadata-rich events any device. The identifiers presented in this work may also be used to definitively detect usage. Likewise, logs carve useful analysis other network-connected peripherals. quantify how long remain recoverable memory. experiments demonstrated that some Indicators Compromise (IOCs) for at least 24 h.