Several USB flash drives labeled Salaries 2026 are found in the office lobby and parking lot. One employee plugged a drive into a workstation, and the endpoint agent then detected a keyboard-emulation device. Which threat vector was used?
Select an answer to reveal the explanation.
Short Explanation
A curiosity-bait label like "Salaries" is the hook, and the drive in your hand is the weapon. That's an external media vector -- a malicious USB that may even pretend to be a keyboard and type commands for you. The fix is simple: you never plug in a drive you found.
Full Explanation
External media-based vectors deliver attacks through removable devices, most notably malicious Universal Serial Bus drives. Attackers drop drives with tempting labels in places employees pass, relying on curiosity. Some malicious drives carry infected files, while others emulate a keyboard and inject keystrokes as soon as they are connected, which explains the endpoint agent's detection of a keyboard-emulation device. The human element is the lure, but the vector itself is the external media. A signal-based vector using Bluetooth would require wireless pairing with the laptop, and the device was physically inserted into a port. A supply chain-based vector through a logistics provider would involve tampering with legitimately shipped hardware, whereas these drives were left in public areas with no delivery involved. An image-based vector using embedded content would rely on images or QR codes to deliver a link, which does not describe a physical drive that emulates a keyboard. Exam caveat: port blocking and device control policies are effective because they stop the vector regardless of what payload the drive carries. Operational check: isolate the workstation, collect the remaining drives as evidence, review device control policy to block unapproved USB device classes, and remind staff to hand found media to the security team.