Description
Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Platforms
Threat Groups (9)
| ID | Group | Context |
|---|---|---|
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has obtained victim's screen dimension and display device information.(Citation: CISA AA24-038A ... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) tools have contained an application to check performance of USB flash drives. [Gamaredon Grou... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has searched for attached VGA devices using lspci.(Citation: Cisco Talos Intelligence Group) |
| G0067 | APT37 | [APT37](https://attack.mitre.org/groups/G0067) has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bl... |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has used tools to identify if a mouse is connected to a targeted system.(Citation: Check Point APT34 A... |
| G0010 | Turla | [Turla](https://attack.mitre.org/groups/G0010) has used <code>fsutil fsinfo drives</code> to list connected drives.(Citation: ESET ComRAT May 2020) |
| G0020 | Equation | [Equation](https://attack.mitre.org/groups/G0020) has used tools with the functionality to search for specific information about the attached hard dri... |
| G0135 | BackdoorDiplomacy | [BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) has used an executable to detect removable media, such as USB flash drives.(Citation: ESET ... |
| G0007 | APT28 | [APT28](https://attack.mitre.org/groups/G0007) uses a module to receive a notification every time a USB mass storage device is inserted into a victim.... |
Associated Software (47)
| ID | Name | Type | Context |
|---|---|---|---|
| S0686 | QuietSieve | Malware | [QuietSieve](https://attack.mitre.org/software/S0686) can identify and search removable drives for specific file name extensions.(Citation: Microsoft ... |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) enumerates removable drives for infection.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien Fe... |
| S1089 | SharpDisco | Malware | [SharpDisco](https://attack.mitre.org/software/S1089) has dropped a plugin to monitor external drives to `C:\Users\Public\It3.exe`.(Citation: Moustach... |
| S0115 | Crimson | Malware | [Crimson](https://attack.mitre.org/software/S0115) has the ability to discover pluggable/removable drives to extract files from.(Citation: Proofpoint ... |
| S9038 | DynoWiper | Malware | [DynoWiper](https://attack.mitre.org/software/S9038) has enumerated and overwritten files on all removeable and fixed drives.(Citation: ESET DynoWiper... |
| S0647 | Turian | Malware | [Turian](https://attack.mitre.org/software/S0647) can scan for removable media to collect data.(Citation: ESET BackdoorDiplomacy Jun 2021) |
| S0409 | Machete | Malware | [Machete](https://attack.mitre.org/software/S0409) detects the insertion of new devices by listening for the WM_DEVICECHANGE window message.(Citation:... |
| S0113 | Prikormka | Malware | A module in [Prikormka](https://attack.mitre.org/software/S0113) collects information on available printers and disk drives.(Citation: ESET Operation ... |
| S0381 | FlawedAmmyy | Malware | [FlawedAmmyy](https://attack.mitre.org/software/S0381) will attempt to detect if a usable smart card is current inserted into a card reader.(Citation:... |
| S0612 | WastedLocker | Malware | [WastedLocker](https://attack.mitre.org/software/S0612) can enumerate removable drives prior to the encryption process.(Citation: Sentinel Labs Wasted... |
| S1167 | AcidPour | Malware | [AcidPour](https://attack.mitre.org/software/S1167) includes functionality to identify MMC and SD cards connected to the victim device.(Citation: Sent... |
| S1149 | CHIMNEYSWEEP | Malware | [CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) can monitor for removable drives.(Citation: Mandiant ROADSWEEP August 2022) |
| S0481 | Ragnar Locker | Malware | [Ragnar Locker](https://attack.mitre.org/software/S0481) may attempt to connect to removable drives and mapped network drives.(Citation: Sophos Ragnar... |
| S0089 | BlackEnergy | Malware | [BlackEnergy](https://attack.mitre.org/software/S0089) can gather very specific information about attached USB devices, to include device instance ID ... |
| S0644 | ObliqueRAT | Malware | [ObliqueRAT](https://attack.mitre.org/software/S0644) can discover pluggable/removable drives to extract files from.(Citation: Talos Oblique RAT March... |
| S0673 | DarkWatchman | Malware | [DarkWatchman](https://attack.mitre.org/software/S0673) can list signed PnP drivers for smartcard readers.(Citation: Prevailion DarkWatchman 2021) |
| S0013 | PlugX | Malware | [PlugX](https://attack.mitre.org/software/S0013) can identify removable media attached to compromised hosts.(Citation: DOJ Affidavit Search and Seizur... |
| S0062 | DustySky | Malware | [DustySky](https://attack.mitre.org/software/S0062) can detect connected USB devices.(Citation: Kaspersky MoleRATs April 2019) |
| S1026 | Mongall | Malware | [Mongall](https://attack.mitre.org/software/S1026) can identify removable media attached to compromised hosts.(Citation: SentinelOne Aoqin Dragon June... |
| S1202 | LockBit 3.0 | Malware | [LockBit 3.0](https://attack.mitre.org/software/S1202) has the ability to discover external storage devices.(Citation: Joint Cybersecurity Advisory Lo... |
References
- Shahriar Shovon. (2018, March). List USB Devices Linux. Retrieved March 11, 2022.
- SS64. (n.d.). system_profiler. Retrieved March 11, 2022.
Frequently Asked Questions
What is T1120 (Peripheral Device Discovery)?
T1120 is a MITRE ATT&CK technique named 'Peripheral Device Discovery'. It belongs to the Discovery tactic(s). Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macO...
How can T1120 be detected?
Detection of T1120 (Peripheral Device Discovery) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1120?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1120?
Known threat groups using T1120 include: Volt Typhoon, Gamaredon Group, TeamTNT, APT37, OilRig, Turla, Equation, BackdoorDiplomacy.