Techniques › T1200
T1200 Hardware Additions
initial access — Windows, Linux, macOS · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
3
Sigma rules tagged attack.t1200
0
KEV CVEs mapped here
<p>Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.</p><p>While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. Adversary-in-the-Middle), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0069 Detect unauthorized or suspicious Hardware Additions (USB/Thunderbolt/Network) v1.0
AN0185 WindowsChain: (1) a new external device is recognized by Windows (USB/Thunderbolt/PCIe) or a new block device appears; (2) within a short window, the same user/session spawns processes or the OS mounts a new volume; (3) optional follow-on activity such as HID keystroke injection, DMA driver load, or new network interface MAC on DHCP. Correlate Security EID 6416 / Kernel-PnP with sysmon and DHCP/network metadata.Tunable:
TrustedDeviceVIDPIDExpectedBusTypesTimeWindowTrustedMACsAN0186 LinuxChain: (1) udev / kernel logs show hot-plug (USB/Thunderbolt/PCIe); (2) block device created by udisks/diskarbitration; (3) optional: new network interface or DHCP lease observed. Correlate /var/log/messages|syslog, auditd SYSCALL open/creat on /dev, and DHCP/Zeek.linux:syslogusb * new|thunderbolt|pci .* added|block.*: new .* device→ DC0038 Application Log ContentTunable:BlocklistDeviceStringsServerClassesNoUSBDHCPVlanScopesAN0187 macOSChain: (1) unified logs report IOUSBHost/IOThunderbolt device arrival; (2) diskarbitrationd attaches a new volume; (3) optional: config profile manipulation or new network interface MAC obtains a lease. Correlate unifiedlogs (subsystems: IOUSBHost, IOKit, diskarbitrationd), FSEvents, and DHCP/Zeek.Tunable:ManagedUSBPolicyKnownAppleAccessories
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1200
Author: Florian Roth (Nextron Systems)
· 2017-11-09 (modified 2021-11-30) · logsource: product=windows service=driver-framework · 1a4bd6e3-4c6e-405d-a9a3-53a116e341d4
Detects plugged/unplugged USB devices
Author: frack113
· 2022-10-14 · logsource: product=windows service=security · c9eb55c3-b468-40ab-9089-db2862e42137
Detects an installation of a device that is forbidden by the system policy
Author: Keith Wright
· 2019-11-20 (modified 2024-02-09) · logsource: product=windows service=security · f69a87ea-955e-4fb4-adb2-bb9fd6685632
Detects external disk drives or plugged-in USB devices.