Peripheral Device Discovery (T1120) is a discovery technique. MITRE lists Linux, macOS and Windows.
It is a quiet technique, and on its own it proves little. Its value to defenders is as a clue that something is preparing for collection.
How attackers use it
MITRE describes adversaries gathering information about attached peripheral devices and components. Examples include keyboards, printers, cameras, smart card readers and removable storage. The information may improve awareness of the system and network environment, or be used for further actions, such as picking a webcam to record or a USB drive to read.
How to detect it
MITRE's strategy is Peripheral Device Enumeration via System Utilities and API Calls. Analytics describe:
- Windows: suspicious enumeration of attached peripherals through WMI, PowerShell or low-level API calls, possibly chained with removable device interaction.
- Linux: enumeration of USB and other hardware with udevadm, lshw, or the /sys and /proc interfaces, close in time to collection or mounting.
- macOS: system_profiler and ioreg used to list hardware or USB devices, especially if followed by clipboard, file or network activity.
The key word is followed. Listing devices happens in normal admin work. Listing devices and then touching a camera, a microphone or a USB volume from the same unusual process is a better signal. Process creation logs with command lines and parent processes are the main data source.
How to reduce the risk
MITRE does not list a formal mitigation, since this is information gathering using legitimate OS features. Practical steps:
- Control removable media and device classes through device management policy.
- Use application control to limit who can run scripting tools.
- Alert on discovery commands only when chained with collection behavior.
Quick check
Why is discovery alone a weak alert?
Administrators and software list devices routinely. The chain matters, such as discovery followed by device access, file activity or network transfer.
Which Linux and macOS tools does MITRE name?
udevadm and lshw on Linux, plus the /sys and /proc interfaces, and system_profiler and ioreg on macOS.
Sources
- MITRE ATT&CK, Peripheral Device Discovery (T1120)
