Cross-source coverage

T1200 / ATT&CK

Hardware Additions

15 rules across 3 sources.

From MITRE ATT&CK 19.2

Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.

While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. Adversary-in-the-Middle), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.

Tactics: Initial Access
Platforms: Windows · Linux · macOS
Telemetry: WinEventLog:SecurityWinEventLog:SysmonWinEventLog:Systemwineventlog:dhcpauditd:SYSCALLlinux:syslogNSM:Flowmacos:unifiedlog

How MITRE says to detect it DET0069

Detect unauthorized or suspicious Hardware Additions (USB/Thunderbolt/Network)

Windows Analytic 0185

Chain: (1) a new external device is recognized by Windows (USB/Thunderbolt/PCIe) or a new block device appears; (2) within a short window, the same user/session spawns processes or the OS mounts a new volume; (3) optional follow-on activity such as HID keystroke injection, DMA driver load, or new network interface MAC on DHCP. Correlate Security EID 6416 / Kernel-PnP with sysmon and DHCP/network metadata.

WinEventLog:Security EventCode=6416
WinEventLog:Sysmon EventCode=1
WinEventLog:Sysmon EventCode=6
WinEventLog:Sysmon EventCode=7
WinEventLog:Sysmon EventCode=11
WinEventLog:Sysmon EventCode=3, 22
WinEventLog:System Kernel-PnP 410/400 device install, disk added
wineventlog:dhcp DHCP Lease Granted

Linux Analytic 0186

Chain: (1) udev / kernel logs show hot-plug (USB/Thunderbolt/PCIe); (2) block device created by udisks/diskarbitration; (3) optional: new network interface or DHCP lease observed. Correlate /var/log/messages|syslog, auditd SYSCALL open/creat on /dev, and DHCP/Zeek.

auditd:SYSCALL mknod,open,openat
linux:syslog usb * new|thunderbolt|pci .* added|block.*: new .* device
NSM:Flow LEASE_GRANTED

macOS Analytic 0187

Chain: (1) unified logs report IOUSBHost/IOThunderbolt device arrival; (2) diskarbitrationd attaches a new volume; (3) optional: config profile manipulation or new network interface MAC obtains a lease. Correlate unifiedlogs (subsystems: IOUSBHost, IOKit, diskarbitrationd), FSEvents, and DHCP/Zeek.

macos:unifiedlog Device attached|enumerated VID/PID
macos:unifiedlog mounted|appeared|DA: disk* attached
NSM:Flow MAC not in allow-list acquiring IP (DHCP)

View on attack.mitre.org ↗

splunk/security_content

10 rules

Detection	Severity	Format
Detect ARP Poisoning	Undefined	SPL
Detect IPv6 Network Infrastructure Threats	Undefined	SPL
Detect Port Security Violation	Undefined	SPL
Detect Rogue DHCP Server	Undefined	SPL
Detect Traffic Mirroring	Undefined	SPL
Linux Auditd Hardware Addition Swapoff	Undefined	SPL
Linux Hardware Addition SwapOff	Undefined	SPL
Windows Process Executed From Removable Media	Undefined	SPL
Windows USBSTOR Registry Key Modification	Undefined	SPL
Windows WPDBusEnum Registry Key Modification	Undefined	SPL

SigmaHQ/sigma

3 rules

Detection	Severity	Format
Device Installation Blocked	Medium	Sigma
External Disk Drive Or USB Storage Device Was Recognized By The System	Low	Sigma
USB Device Plugged	Low	Sigma

Azure/Azure-Sentinel

2 rules

Detection	Severity	Format
BadUSB HID injection PowerShell via Windows Run dialog	Undefined	KQL
BadUSB LOLBIN execution via certutil (HID injection via Run dialog)	Undefined	KQL