Adversaries may gather information about the hardware of a victim's hosts. MITRE lists this under Reconnaissance with platform PRE, last modified in September 2026. Details include types and versions on specific hosts, and the presence of components that suggest added defenses, such as card or biometric readers and dedicated encryption hardware.
How attackers use it
MITRE says collection can be direct, through active scanning such as hostnames, server banners, and user agent strings, or through phishing for information. Adversaries may also compromise sites and add content that collects host information from visitors.
The data may also be exposed in job postings, network maps, assessment reports, resumes, or purchase invoices. The results can lead to more reconnaissance, to obtaining capabilities, and to initial access through compromise of the hardware supply chain or hardware additions.
How to detect it
MITRE notes that this activity may have a very high occurrence and false positive rate, and may take place outside your visibility, which makes detection difficult. Its advice is to focus on related stages of the adversary lifecycle, such as initial access.
MITRE adds that internet scanners may be used to look for patterns associated with malicious content designed to collect information from visitors.
How to reduce the risk
- MITRE says this technique cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. Its guidance is to minimize the amount and sensitivity of data available to external parties.
- Check job postings, public assessment reports, and vendor case studies for hardware detail.
- Limit banners and hostnames that disclose model or function.
- Control who sees purchase documents, and what appears on shared invoices.
- Buy hardware through trusted channels and verify it on arrival.
Quick check
Which documents may expose hardware details?
Job postings, network maps, assessment reports, resumes, and purchase invoices.
Which initial access techniques link to this one?
Compromise of the hardware supply chain and hardware additions.
Sources
- MITRE ATT&CK, Hardware (T1592.001): https://attack.mitre.org/techniques/T1592/001
