Mouse Without Borders Abuse – PoCs

This repository contains C# scripts and a BOF, demonstrating potential abuse scenarios of Microsoft's Mouse Without Borders (MWB) tool.

Contents

• TransitionDetector.cs
  Monitors mouse position to detect control switch to a paired device, then simulates keystrokes (e.g., WIN+R) to run a payload — launches calc in this PoC.

• HotkeySwitch.cs
  Simulates pressing the MWB shortcut (e.g., CTRL+ALT+F3) to switch control to connected device then injects (WIN+R → calc → ENTER). Could be enhanced to read the settings.json file and know which device is connected and what shortcut to use...

• mwb_injector.bof
  A Beacon Object File that integrates with Cobalt Strike, simulates switching to a paired device then injecting keystrokes via MWB.

Blog Post Reference

Read the full blog post for technical analysis, detection guidance, and forensic investigation details.