Cross-source coverage

T1120 / ATT&CK

Peripheral Device Discovery

9 rules across 4 sources.

From MITRE ATT&CK 19.2

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.

Tactics
Discovery
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLlinux:osquerymacos:unifiedlogmacos:osquery

How MITRE says to detect it DET0491

Peripheral Device Enumeration via System Utilities and API Calls

Windows Analytic 1353

Suspicious enumeration of attached peripherals via WMI, PowerShell, or low-level API calls potentially chained with removable device interactions.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=10

Linux Analytic 1354

Enumeration of USB and other peripheral hardware via udevadm, lshw, or /sys or /proc interfaces in proximity to collection or mounting behavior.

  • auditd:SYSCALL execve
  • auditd:SYSCALL open/read
  • linux:osquery hardware_events

macOS Analytic 1355

Execution of system utilities like 'system_profiler' and 'ioreg' to enumerate hardware components or USB devices, particularly if followed by clipboard, file, or network activity.

  • macos:unifiedlog process exec
  • macos:osquery usb_devices

View on attack.mitre.org ↗

socfortress/Wazuh-Rules

4 rules
Detection Severity Format
Sysmon - Event 1: Process creation · FSUTIL Drives Discovery (T1120) High Wazuh XML
Sysmon - Event 1: Process creation · Get-Printer Peripheral Discovery (T1120) High Wazuh XML
Sysmon - Event 1: Process creation · Get-WMIObject Peripheral Discovery (T1120) High Wazuh XML
Sysmon - Event 1: Process creation · WinPwn Printercheck (T1120) High Wazuh XML

SigmaHQ/sigma

2 rules
Detection Severity Format
Fsutil Drive Enumeration Low Sigma
Powershell Suspicious Win32_PnPEntity Low Sigma

elastic/detection-rules

2 rules
Detection Severity Format
PowerShell Suspicious Script with Audio Capture Capabilities High Elastic TOML
Peripheral Device Discovery Low Elastic TOML

Wazuh Core Ruleset

1 rule
Detection Severity Format
Powershell queried Win32_PnPEntity. Possible devices/adapter discovery activity Low Wazuh XML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.