Hardware Additions (MITRE ATT&CK T1200) is the physical introduction of computer accessories, networking hardware or other devices into a system or network as a way to gain access. MITRE files it under Initial Access and lists Linux, Windows and macOS.
How attackers use it
MITRE separates this from spreading payloads on removable storage. More capable hardware additions can add new functions that are then abused. MITRE notes that public references of threat actor use are scarce, but many red teams and penetration testers use hardware additions for initial access. Commercial and open source products can offer passive network tapping, network traffic modification such as adversary-in-the-middle, keystroke injection, kernel memory reading through DMA, and new wireless access points added to an existing network.
The MITRE page lists one actor that physically connected small computers, inexpensive laptops and USB attack devices to a target's environment to reach its local network.
How to detect it
MITRE's detection strategy watches for new devices and what follows.
- Windows. A new external device (USB, Thunderbolt, PCIe) is recognized, or a new block device appears. Soon after, the same user or session spawns processes or the system mounts a new volume. Correlate Security event ID 6416 and Kernel-PnP events with Sysmon and DHCP or network data.
- Linux. udev and kernel logs show a hot-plug event, and a block device is created. Correlate syslog or messages logs, auditd records and DHCP or Zeek data.
- macOS. Unified logs show IOUSBHost or IOThunderbolt device arrival, and diskarbitrationd attaches a volume.
Optional follow-on signs are keystroke injection from a device that looks like a keyboard, a DMA driver load, or a new network interface MAC address getting a DHCP lease.
How to reduce the risk
- Control network access. Use network access control policies such as device certificates and 802.1x. Restrict DHCP to registered devices so unregistered devices cannot talk to trusted systems.
- Limit hardware installation. Block unknown devices and accessories through endpoint security configuration and a monitoring agent.
Physical controls matter too: lock network closets and disable unused wall ports.
Quick check
Which Windows event does MITRE name for new devices?
Security event ID 6416, alongside Kernel-PnP events.
