Technique.View on attack.mitre.org
Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Rules on DetectionCode tagged with T1120.
| Rule | Level | Log source |
|---|---|---|
| Fsutil Drive Enumeration | low | windows / process_creation |
| Powershell Suspicious Win32_PnPEntity | low | windows / ps_script |
| Used by | Procedure example |
|---|---|
| GroupAPT28 | APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim. |
| GroupAPT37 | APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices. |
| GroupBackdoorDiplomacy | BackdoorDiplomacy has used an executable to detect removable media, such as USB flash drives. |
| GroupEquation | Equation has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware. |
| GroupGamaredon Group | Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives. |
| GroupOilRig | OilRig has used tools to identify if a mouse is connected to a targeted system. |
| GroupTeamTNT | TeamTNT has searched for attached VGA devices using lspci. |
| GroupTurla | Turla has used |
| Used by | Procedure example |
|---|---|
| MalwareAcidPour | AcidPour includes functionality to identify MMC and SD cards connected to the victim device. |
| MalwareADVSTORESHELL | ADVSTORESHELL can list connected devices. |
| MalwareAttor | Attor has a plugin that collects information about inserted storage devices, modems, and phone devices. |
| MalwareBADNEWS | BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message. |
| MalwareBandook | Bandook can detect USB devices. |
| MalwareBlackEnergy | BlackEnergy can gather very specific information about attached USB devices, to include device instance ID and drive geometry. |
| MalwareCadelspy | Cadelspy has the ability to steal information about printers and the documents sent to printers. |
| MalwareCHIMNEYSWEEP | CHIMNEYSWEEP can monitor for removable drives. |
| Used by | Procedure example |
|---|---|
| CampaignOperation CuckooBees | During Operation CuckooBees, the threat actors used the `fsutil fsinfo drives` command as part of their advanced reconnaissance. |
| CampaignOperation Wocao | During Operation Wocao, threat actors discovered removable disks attached to a system. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
