Skip to content

Instantly share code, notes, and snippets.

@mbrownnycnyc

mbrownnycnyc/get-mousejacked.ps1

Last active April 14, 2016 18:34
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mbrownnycnyc/9edc1fae600ea9e74e8f to your computer and use it in GitHub Desktop.
Save mbrownnycnyc/9edc1fae600ea9e74e8f to your computer and use it in GitHub Desktop.
Download ZIP
This will assist in identifying computers that are vulnerable to the novel attacks describe and provided by Bastille via https://www.bastille.net/affected-devices. See: https://support.microsoft.com/en-us/kb/3152550
Raw
get-mousejacked.ps1
#https://www.bastille.net/affected-devices
#https://www.schneier.com/blog/archives/2016/03/security_vulner_6.html
Import-Module ActiveDirectory
$adsearchpath = "OU=Workstations,DC=contoso,DC=corp"
gwmi win32_PnPEntity -computer (get-adcomputer -searchbase $adsearchpath -Filter * | select name -ExpandProperty name) -filter '
(DeviceID like "%VID_04f2&PID_0976%" and Caption like "USB Input Device") or
(DeviceID like "%VID_046d&PID_c52b%" and Caption like "USB Input Device") or
(DeviceID like "%VID_413c&PID_2501%" and Caption like "USB Input Device") or
(DeviceID like "%VID_04b4&PID_0060%" and Caption like "USB Input Device") or
(DeviceID like "%VID_03f0&PID_d407%" and Caption like "USB Input Device") or
(DeviceID like "%VID_17ef&PID_6071%" and Caption like "USB Input Device") or
(DeviceID like "%VID_046d&PID_c52b%" and Caption like "USB Input Device") or
(DeviceID like "%VID_045e&PID_0745%" and Caption like "USB Input Device") or
(DeviceID like "%VID_045e&PID_07b2%" and Caption like "USB Input Device") or
(DeviceID like "%VID_045e&PID_07a5%" and Caption like "USB Input Device")' | select systemname, deviceid, caption, description
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment