{"id":"T1200","name":"Hardware Additions","url":"https://attack.mitre.org/techniques/T1200","tactics":["initial-access"],"platforms":["Windows","Linux","macOS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0069","stix_id":"x-mitre-detection-strategy--e8d186eb-5450-4dc9-8458-89bbaed45643","name":"Detect unauthorized or suspicious Hardware Additions (USB/Thunderbolt/Network)","url":"https://attack.mitre.org/detectionstrategies/DET0069","analytics":[{"id":"AN0185","stix_id":"x-mitre-analytic--61d89912-f74e-4fde-ae7a-591e8c7c5739","name":"Analytic 0185","description":"Chain: (1) a new external device is recognized by Windows (USB/Thunderbolt/PCIe) or a new block device appears; (2) within a short window, the same user/session spawns processes or the OS mounts a new volume; (3) optional follow-on activity such as HID keystroke injection, DMA driver load, or new network interface MAC on DHCP. Correlate Security EID 6416 / Kernel-PnP with sysmon and DHCP/network metadata.","url":"https://attack.mitre.org/detectionstrategies/DET0069#AN0185","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=6416","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=6","data_component":"DC0079","data_component_name":"Driver Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:System","channel":"Kernel-PnP 410/400 device install, disk added","data_component":"DC0042","data_component_name":"Drive Creation","log_source_slug":"wineventlog-system"},{"name":"wineventlog:dhcp","channel":"DHCP Lease Granted","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"wineventlog-dhcp"}],"mutable_elements":[{"field":"TrustedDeviceVIDPID","description":"Vendor/Product IDs that are approved (e.g., keyboards, mice). Unknown/rare VID:PID raise risk."},{"field":"ExpectedBusTypes","description":"Allow-listed bus types for server classes (e.g., USB disabled on DCs)."},{"field":"TimeWindow","description":"Correlation window between device recognition and follow-on process/mount/network activity (e.g., 10m–60m)."},{"field":"TrustedMACs","description":"Known NIC/USB-NIC MAC addresses allowed by policy."}],"live":true,"detection_strategies":["DET0069"],"techniques":["T1200"]},{"id":"AN0186","stix_id":"x-mitre-analytic--81cd2610-bc6c-46bf-8d3c-d6e30c7f51c8","name":"Analytic 0186","description":"Chain: (1) udev / kernel logs show hot-plug (USB/Thunderbolt/PCIe); (2) block device created by udisks/diskarbitration; (3) optional: new network interface or DHCP lease observed. Correlate /var/log/messages|syslog, auditd SYSCALL open/creat on /dev, and DHCP/Zeek.","url":"https://attack.mitre.org/detectionstrategies/DET0069#AN0186","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"mknod,open,openat","data_component":"DC0042","data_component_name":"Drive Creation","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"usb * new|thunderbolt|pci .* added|block.*: new .* device","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"linux-syslog"},{"name":"NSM:Flow","channel":"LEASE_GRANTED","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"BlocklistDeviceStrings","description":"Indicators such as 'RubberDucky', 'BadUSB', unfamiliar USB-NIC chipsets."},{"field":"ServerClassesNoUSB","description":"Hosts where any USB attach should alert (DCs, hypervisors)."},{"field":"DHCPVlanScopes","description":"Scopes allowed to issue leases for corp endpoints vs. guest/IoT."}],"live":true,"detection_strategies":["DET0069"],"techniques":["T1200"]},{"id":"AN0187","stix_id":"x-mitre-analytic--5bbe0089-4927-4415-bff7-14a3ba5543c0","name":"Analytic 0187","description":"Chain: (1) unified logs report IOUSBHost/IOThunderbolt device arrival; (2) diskarbitrationd attaches a new volume; (3) optional: config profile manipulation or new network interface MAC obtains a lease. Correlate unifiedlogs (subsystems: IOUSBHost, IOKit, diskarbitrationd), FSEvents, and DHCP/Zeek.","url":"https://attack.mitre.org/detectionstrategies/DET0069#AN0187","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Device attached|enumerated VID/PID","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"mounted|appeared|DA: disk* attached","data_component":"DC0042","data_component_name":"Drive Creation","log_source_slug":"macos-unifiedlog"},{"name":"NSM:Flow","channel":"MAC not in allow-list acquiring IP (DHCP)","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ManagedUSBPolicy","description":"MDM profile expectations for external media and Thunderbolt mode; deviations alert."},{"field":"KnownAppleAccessories","description":"VID/PID for corporate-issued docks/keyboards."}],"live":true,"detection_strategies":["DET0069"],"techniques":["T1200"]}],"live":true,"version":"1.0","techniques":["T1200"]}],"sigma_rules":[{"id":"1a4bd6e3-4c6e-405d-a9a3-53a116e341d4","title":"USB Device Plugged","author":"Florian Roth (Nextron Systems)","status":"test","level":"low","date":"2017-11-09","modified":"2021-11-30","description":"Detects plugged/unplugged USB devices","references":["https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/","https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/"],"logsource":{"product":"windows","service":"driver-framework"},"tags":["attack.initial-access","attack.t1200"],"path":"rules/windows/builtin/driverframeworks/win_usb_device_plugged.yml","techniques":["T1200"],"cves":[]},{"id":"c9eb55c3-b468-40ab-9089-db2862e42137","title":"Device Installation Blocked","author":"frack113","status":"test","level":"medium","date":"2022-10-14","modified":null,"description":"Detects an installation of a device that is forbidden by the system policy","references":["https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6423"],"logsource":{"product":"windows","service":"security"},"tags":["attack.initial-access","attack.t1200"],"path":"rules/windows/builtin/security/win_security_device_installation_blocked.yml","techniques":["T1200"],"cves":[]},{"id":"f69a87ea-955e-4fb4-adb2-bb9fd6685632","title":"External Disk Drive Or USB Storage Device Was Recognized By The System","author":"Keith Wright","status":"test","level":"low","date":"2019-11-20","modified":"2024-02-09","description":"Detects external disk drives or plugged-in USB devices.","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6416"],"logsource":{"product":"windows","service":"security"},"tags":["attack.t1091","attack.t1200","attack.lateral-movement","attack.initial-access"],"path":"rules/windows/builtin/security/win_security_external_device.yml","techniques":["T1091","T1200"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}