---
id: 7564
title: "Plug & Pwn: Mapping the Windows PnP Auto-Install Attack Surface"
source_domain: netlas.io
source_url: "https://netlas.io/blog/windows_pnp_auto_install_attack_surface/"
published_at: "2026-09-10T00:00:00Z"
tags: ["attack-surface", "privilege-escalation", "windows", "rdp", "defcon", "netlas", "plug-and-play"]
phying_url: "https://phying.com/item/7564"
lang: en
---

# Plug & Pwn: Mapping the Windows PnP Auto-Install Attack Surface

## Summary

Netlas maps Windows PnP auto-install from DEF CON's Plug & Pwn: the OS fetches and runs vendor packages as SYSTEM; the remote variant rides authenticated RDP, so exposure can be scoped from outside.

## Intelligence Metadata

- **Sources:** netlas.io
- **Published:** 2026-09-10T00:00:00Z
- **Original:** https://netlas.io/blog/windows_pnp_auto_install_attack_surface/
- **Phying News:** https://phying.com/item/7564