{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1120","id":"T1120","name":"Peripheral Device Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1120","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"834e05b6ce4e067216565d3cae96390a7a5b4d73d992a7478a45a418bbae06cd","description":"Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1120","external_id":"T1120"},{"source_name":"Peripheral Discovery Linux","description":"Shahriar Shovon. (2018, March). List USB Devices Linux. Retrieved March 11, 2022.","url":"https://linuxhint.com/list-usb-devices-linux/"},{"source_name":"Peripheral Discovery macOS","description":"SS64. (n.d.). system_profiler. Retrieved March 11, 2022.","url":"https://ss64.com/osx/system_profiler.html"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0054","name":"Drive Access","page":"telemetry/DC0054/","kind":"attack_component","category":"Endpoint activity","description":"Access to a disk/drive device, including supported raw-read observations.","collection_focus":"For Windows raw reads, review Sysmon RawAccessRead (9); collect device path and process. Normal file I/O is a different source.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["device_path","process_id","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0054","collector":"illustrative-lab-collector","observation":{"device_path":"\\\\.\\PhysicalDrive2","process_id":4200,"action":"raw_read"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0035","name":"Process Access","page":"telemetry/DC0035/","kind":"attack_component","category":"Endpoint activity","description":"One process opening or accessing another process.","collection_focus":"Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["source_process_id","target_process_id","granted_access","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1120","id":"T1120","name":"Peripheral Device Discovery","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1120","technique_page":"techniques/enterprise/T1120/","page":"detections/enterprise/T1120/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"b26647de-4feb-4283-af6b-6117661283c5","title":"Powershell Suspicious Win32_PnPEntity","status":"test","level":"low","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/b26647de-4feb-4283-af6b-6117661283c5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_win32_pnpentity.yml","author":"frack113","kind":"sigma"},{"id":"63de06b9-a385-40b5-8b32-73f2b9ef84b6","title":"Fsutil Drive Enumeration","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/63de06b9-a385-40b5-8b32-73f2b9ef84b6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_fsutil_drive_enumeration.yml","author":"Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0491","name":"Peripheral Device Enumeration via System Utilities and API Calls","url":"https://attack.mitre.org/detectionstrategies/DET0491","stix_id":"x-mitre-detection-strategy--f273ee4a-e468-4a01-bb1a-f3a687518ded","relationship_id":"relationship--c1e95758-4497-406e-a9a7-a5476bacc6f1","description":"","analytics":[{"id":"AN1353","name":"Analytic 1353","guidance":"Suspicious enumeration of attached peripherals via WMI, PowerShell, or low-level API calls potentially chained with removable device interactions.","url":"https://attack.mitre.org/detectionstrategies/DET0491#AN1353","platforms":["Windows"],"tuning":[{"field":"CommandLineRegex","description":"Regex patterns for device enumeration utilities (e.g., 'Get-PnpDevice', 'wmic path Win32_USBController')"},{"field":"TimeWindow","description":"Time threshold for grouping device discovery with follow-on access or manipulation"},{"field":"UserContext","description":"Filter privileged or service accounts known to legitimately execute enumeration scripts"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN1353","source_url":"https://attack.mitre.org/detectionstrategies/DET0491#AN1353","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0035","component":"Process Access","name":"WinEventLog:Sysmon","channel":"EventCode=10","platforms":["Windows"],"analytic_id":"AN1353","source_url":"https://attack.mitre.org/detectionstrategies/DET0491#AN1353","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"}]},{"id":"AN1354","name":"Analytic 1354","guidance":"Enumeration of USB and other peripheral hardware via udevadm, lshw, or /sys or /proc interfaces in proximity to collection or mounting behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0491#AN1354","platforms":["Linux"],"tuning":[{"field":"ExecutableList","description":"Set of binaries used for peripheral enumeration (e.g., 'lshw', 'lsusb', 'udevadm')"},{"field":"UserContext","description":"Tuning based on which users/scripts are authorized to query device state"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN1354","source_url":"https://attack.mitre.org/detectionstrategies/DET0491#AN1354","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"open/read","platforms":["Linux"],"analytic_id":"AN1354","source_url":"https://attack.mitre.org/detectionstrategies/DET0491#AN1354","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0054","component":"Drive Access","name":"linux:osquery","channel":"hardware_events","platforms":["Linux"],"analytic_id":"AN1354","source_url":"https://attack.mitre.org/detectionstrategies/DET0491#AN1354","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0054/"}]},{"id":"AN1355","name":"Analytic 1355","guidance":"Execution of system utilities like 'system_profiler' and 'ioreg' to enumerate hardware components or USB devices, particularly if followed by clipboard, file, or network activity.","url":"https://attack.mitre.org/detectionstrategies/DET0491#AN1355","platforms":["macOS"],"tuning":[{"field":"BinaryList","description":"Commands like 'system_profiler SPUSBDataType', 'ioreg -p IOUSB' that may indicate enumeration"},{"field":"TimeWindow","description":"Temporal grouping of enumeration with follow-on activity (e.g., clipboard capture, exfiltration)"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"process exec","platforms":["macOS"],"analytic_id":"AN1355","source_url":"https://attack.mitre.org/detectionstrategies/DET0491#AN1355","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0054","component":"Drive Access","name":"macos:osquery","channel":"usb_devices","platforms":["macOS"],"analytic_id":"AN1355","source_url":"https://attack.mitre.org/detectionstrategies/DET0491#AN1355","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0054/"}]}]}],"telemetry_references":[{"id":"DC0054","name":"Drive Access","tag":"Drive Access","page":"telemetry/DC0054/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0035","name":"Process Access","tag":"Process Access","page":"telemetry/DC0035/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) can identify removable media attached to compromised hosts.(Citation: DOJ Affidavit Search and Seizure PlugX December 2024)","relationship_id":"relationship--d1c69dc2-dce7-4f6e-a725-03aa8356b54d","references":[{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","description":"DOJ. (2024, December 20). Mag. No. 24-mj-1387 AFFIDAVIT IN SUPPORT OF AN APPLICATION  FOR A NINTH SEARCH AND SEIZURE WARRANT- IN THE MATTER OF THE SEARCH AND  SEIZURE OF COMPUTERS IN THE  UNITED STATES INFECTED WITH  PLUGX MALWARE . Retrieved September 9, 2025.","url":"https://www.justice.gov/archives/opa/media/1384136/dl"}]},{"id":"S0045","name":"ADVSTORESHELL","url":"https://attack.mitre.org/software/S0045","kind":"malware","description":"[ADVSTORESHELL](https://attack.mitre.org/software/S0045) can list connected devices.(Citation: ESET Sednit Part 2)","relationship_id":"relationship--a0f1273a-e422-4801-a911-e7cb223ebea2","references":[{"source_name":"ESET Sednit Part 2","description":"ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"}]},{"id":"S0062","name":"DustySky","url":"https://attack.mitre.org/software/S0062","kind":"malware","description":"[DustySky](https://attack.mitre.org/software/S0062) can detect connected USB devices.(Citation: Kaspersky MoleRATs April 2019)","relationship_id":"relationship--62a7f7c2-435d-4ef6-aee3-add933fb241d","references":[{"source_name":"Kaspersky MoleRATs April 2019","description":"GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020.","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}]},{"id":"S0089","name":"BlackEnergy","url":"https://attack.mitre.org/software/S0089","kind":"malware","description":"[BlackEnergy](https://attack.mitre.org/software/S0089) can gather very specific information about attached USB devices, to include device instance ID and drive geometry.(Citation: Securelist BlackEnergy Nov 2014)","relationship_id":"relationship--7cac6ccb-d070-47da-8ebf-4034b0fddb7c","references":[{"source_name":"Securelist BlackEnergy Nov 2014","description":"Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016.","url":"https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/"}]},{"id":"S0098","name":"T9000","url":"https://attack.mitre.org/software/S0098","kind":"malware","description":"[T9000](https://attack.mitre.org/software/S0098) searches through connected drives for removable storage devices.(Citation: Palo Alto T9000 Feb 2016)","relationship_id":"relationship--ea93ff11-939f-449a-a222-4273d9fc9f3c","references":[{"source_name":"Palo Alto T9000 Feb 2016","description":"Grunzweig, J. and Miller-Osborn, J.. (2016, February 4). T9000: Advanced Modular Backdoor Uses Complex Anti-Analysis Techniques. Retrieved April 15, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/02/t9000-advanced-modular-backdoor-uses-complex-anti-analysis-techniques/"}]},{"id":"S0113","name":"Prikormka","url":"https://attack.mitre.org/software/S0113","kind":"malware","description":"A module in [Prikormka](https://attack.mitre.org/software/S0113) collects information on available printers and disk drives.(Citation: ESET Operation Groundbait)","relationship_id":"relationship--33e0178f-c9b2-43db-9e63-3e664ae6bef0","references":[{"source_name":"ESET Operation Groundbait","description":"Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"}]},{"id":"S0115","name":"Crimson","url":"https://attack.mitre.org/software/S0115","kind":"malware","description":"[Crimson](https://attack.mitre.org/software/S0115) has the ability to discover pluggable/removable drives to extract files from.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)","relationship_id":"relationship--94a9ee1e-ac65-47aa-a8f4-6695f02d6040","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","description":"Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Kaspersky Transparent Tribe August 2020","description":"Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.","url":"https://securelist.com/transparent-tribe-part-1/98127/"}]},{"id":"S0128","name":"BADNEWS","url":"https://attack.mitre.org/software/S0128","kind":"malware","description":"[BADNEWS](https://attack.mitre.org/software/S0128) checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.(Citation: Forcepoint Monsoon)(Citation: TrendMicro Patchwork Dec 2017)","relationship_id":"relationship--f9c7d0e1-135f-4e21-8251-3049bc24c18d","references":[{"source_name":"Forcepoint Monsoon","description":"Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"},{"source_name":"TrendMicro Patchwork Dec 2017","description":"Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"id":"S0136","name":"USBStealer","url":"https://attack.mitre.org/software/S0136","kind":"malware","description":"[USBStealer](https://attack.mitre.org/software/S0136) monitors victims for insertion of removable drives. When dropped onto a second victim, it also enumerates drives connected to the system.(Citation: ESET Sednit USBStealer 2014)","relationship_id":"relationship--f7740e3c-c143-40b7-a8da-e797f5d74b50","references":[{"source_name":"ESET Sednit USBStealer 2014","description":"Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017.","url":"http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/"}]},{"id":"S0148","name":"RTM","url":"https://attack.mitre.org/software/S0148","kind":"malware","description":"[RTM](https://attack.mitre.org/software/S0148) can obtain a list of smart card readers attached to the victim.(Citation: ESET RTM Feb 2017)(Citation: Unit42 Redaman January 2019)","relationship_id":"relationship--45f9e4b6-a6a0-4f9f-aae9-9e8a69f5681d","references":[{"source_name":"ESET RTM Feb 2017","description":"Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"},{"source_name":"Unit42 Redaman January 2019","description":"Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.","url":"https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"}]},{"id":"S0149","name":"MoonWind","url":"https://attack.mitre.org/software/S0149","kind":"malware","description":"[MoonWind](https://attack.mitre.org/software/S0149) obtains the number of removable drives from the victim.(Citation: Palo Alto MoonWind March 2017)","relationship_id":"relationship--5cceffd9-5818-4481-bce6-4e326548d6b4","references":[{"source_name":"Palo Alto MoonWind March 2017","description":"Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.","url":"http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"}]},{"id":"S0234","name":"Bandook","url":"https://attack.mitre.org/software/S0234","kind":"malware","description":"[Bandook](https://attack.mitre.org/software/S0234) can detect USB devices.(Citation: EFF Manul Aug 2016)","relationship_id":"relationship--5047ac79-8ed7-4f22-bfa2-fad8195f72b8","references":[{"source_name":"EFF Manul Aug 2016","description":"Galperin, E., Et al.. (2016, August). I Got a Letter From the Government the Other Day.... Retrieved April 25, 2018.","url":"https://www.eff.org/files/2016/08/03/i-got-a-letter-from-the-government.pdf"}]},{"id":"S0251","name":"Zebrocy","url":"https://attack.mitre.org/software/S0251","kind":"malware","description":"[Zebrocy](https://attack.mitre.org/software/S0251) enumerates information about connected storage devices.(Citation: Unit42 Cannon Nov 2018)","relationship_id":"relationship--45f3afcd-d0b7-494b-a61a-cad724dbf72a","references":[{"source_name":"Unit42 Cannon Nov 2018","description":"Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"}]},{"id":"S0283","name":"jRAT","url":"https://attack.mitre.org/software/S0283","kind":"malware","description":"[jRAT](https://attack.mitre.org/software/S0283) can map UPnP ports.(Citation: Kaspersky Adwind Feb 2016)","relationship_id":"relationship--0c93519a-28a4-4d29-99bc-02c4d0e53ae2","references":[{"source_name":"Kaspersky Adwind Feb 2016","description":"Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf"}]},{"id":"S0366","name":"WannaCry","url":"https://attack.mitre.org/software/S0366","kind":"malware","description":"[WannaCry](https://attack.mitre.org/software/S0366) contains a thread that will attempt to scan for new attached drives every few seconds. If one is identified, it will encrypt the files on the attached device.(Citation: FireEye WannaCry 2017)","relationship_id":"relationship--3f58682a-dc04-40f6-b224-42bab6ef6f67","references":[{"source_name":"FireEye WannaCry 2017","description":"Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019.","url":"https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"}]},{"id":"S0381","name":"FlawedAmmyy","url":"https://attack.mitre.org/software/S0381","kind":"malware","description":"[FlawedAmmyy](https://attack.mitre.org/software/S0381) will attempt to detect if a usable smart card is current inserted into a card reader.(Citation: Proofpoint TA505 Mar 2018)","relationship_id":"relationship--97361e60-4c54-48f6-a661-e3bd36b9745e","references":[{"source_name":"Proofpoint TA505 Mar 2018","description":"Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.","url":"https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware"}]},{"id":"S0385","name":"njRAT","url":"https://attack.mitre.org/software/S0385","kind":"malware","description":"[njRAT](https://attack.mitre.org/software/S0385) will attempt to detect if the victim system has a camera during the initial infection. [njRAT](https://attack.mitre.org/software/S0385) can also detect any removable drives connected to the system.(Citation: Fidelis njRAT June 2013)(Citation: Trend Micro njRAT 2018)","relationship_id":"relationship--30180ece-4504-4b6a-9182-5a2fbe3292df","references":[{"source_name":"Fidelis njRAT June 2013","description":"Fidelis Cybersecurity. (2013, June 28). Fidelis Threat Advisory #1009: \"njRAT\" Uncovered. Retrieved June 4, 2019.","url":"https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"},{"source_name":"Trend Micro njRAT 2018","description":"Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/"}]},{"id":"S0409","name":"Machete","url":"https://attack.mitre.org/software/S0409","kind":"malware","description":"[Machete](https://attack.mitre.org/software/S0409) detects the insertion of new devices by listening for the WM_DEVICECHANGE window message.(Citation: ESET Machete July 2019)  ","relationship_id":"relationship--b71a28d8-a1b1-41b4-a0ac-f92bef513c6e","references":[{"source_name":"ESET Machete July 2019","description":"ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}]},{"id":"S0438","name":"Attor","url":"https://attack.mitre.org/software/S0438","kind":"malware","description":"[Attor](https://attack.mitre.org/software/S0438) has a plugin that collects information about inserted storage devices, modems, and phone devices.(Citation: ESET Attor Oct 2019)","relationship_id":"relationship--68ab9dc7-4258-439c-b011-945175476fb7","references":[{"source_name":"ESET Attor Oct 2019","description":"Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}]},{"id":"S0452","name":"USBferry","url":"https://attack.mitre.org/software/S0452","kind":"malware","description":"[USBferry](https://attack.mitre.org/software/S0452) can check for connected USB devices.(Citation: TrendMicro Tropic Trooper May 2020)","relationship_id":"relationship--57e57dc4-b813-4e5c-882a-0021c7e0ff22","references":[{"source_name":"TrendMicro Tropic Trooper May 2020","description":"Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"id":"S0454","name":"Cadelspy","url":"https://attack.mitre.org/software/S0454","kind":"malware","description":"[Cadelspy](https://attack.mitre.org/software/S0454) has the ability to steal information about printers and the documents sent to printers.(Citation: Symantec Chafer Dec 2015)","relationship_id":"relationship--dfdd269c-9d78-46da-8b31-3141a5398bfd","references":[{"source_name":"Symantec Chafer Dec 2015","description":"Symantec Security Response. (2015, December 7). Iran-based attackers use back door threats to spy on Middle Eastern targets. Retrieved April 17, 2019.","url":"https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets"}]},{"id":"S0458","name":"Ramsay","url":"https://attack.mitre.org/software/S0458","kind":"malware","description":"[Ramsay](https://attack.mitre.org/software/S0458) can scan for removable media which may contain documents for collection.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)\t","relationship_id":"relationship--55d84559-7bb9-4e17-be60-7694e4219877","references":[{"source_name":"Eset Ramsay May 2020","description":"Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"},{"source_name":"Antiy CERT Ramsay April 2020","description":"Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.","url":"https://www.programmersought.com/article/62493896999/"}]},{"id":"S0467","name":"TajMahal","url":"https://attack.mitre.org/software/S0467","kind":"malware","description":"[TajMahal](https://attack.mitre.org/software/S0467) has the ability to identify connected Apple devices.(Citation: Kaspersky TajMahal April 2019)","relationship_id":"relationship--ee1558f7-5b93-49c7-89c8-b3151cbefb84","references":[{"source_name":"Kaspersky TajMahal April 2019","description":"GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.","url":"https://securelist.com/project-tajmahal/90240/"}]},{"id":"S0481","name":"Ragnar Locker","url":"https://attack.mitre.org/software/S0481","kind":"malware","description":"[Ragnar Locker](https://attack.mitre.org/software/S0481) may attempt to connect to removable drives and mapped network drives.(Citation: Sophos Ragnar May 2020)","relationship_id":"relationship--ea79bf34-c1ba-4523-879f-441d6a4a9e5e","references":[{"source_name":"Sophos Ragnar May 2020","description":"SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys virtual machine to dodge security. Retrieved June 29, 2020.","url":"https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/"}]},{"id":"S0538","name":"Crutch","url":"https://attack.mitre.org/software/S0538","kind":"malware","description":"[Crutch](https://attack.mitre.org/software/S0538) can monitor for removable drives being plugged into the compromised machine.(Citation: ESET Crutch December 2020)","relationship_id":"relationship--0e1de5dd-5f5c-4014-899b-0ab676322d80","references":[{"source_name":"ESET Crutch December 2020","description":"Faou, M. (2020, December 2). Turla Crutch: Keeping the “back door” open. Retrieved December 4, 2020.","url":"https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) enumerates removable drives for infection.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--96640478-b6a5-40b6-8928-b1c0cc5ad3ef","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S0612","name":"WastedLocker","url":"https://attack.mitre.org/software/S0612","kind":"malware","description":"[WastedLocker](https://attack.mitre.org/software/S0612) can enumerate removable drives prior to the encryption process.(Citation: Sentinel Labs WastedLocker July 2020)","relationship_id":"relationship--a6959fa0-405c-49b9-983e-653569247dbd","references":[{"source_name":"Sentinel Labs WastedLocker July 2020","description":"Walter, J.. (2020, July 23). WastedLocker Ransomware: Abusing ADS and NTFS File Attributes. Retrieved September 14, 2021.","url":"https://www.sentinelone.com/labs/wastedlocker-ransomware-abusing-ads-and-ntfs-file-attributes/"}]},{"id":"S0644","name":"ObliqueRAT","url":"https://attack.mitre.org/software/S0644","kind":"malware","description":"[ObliqueRAT](https://attack.mitre.org/software/S0644) can discover pluggable/removable drives to extract files from.(Citation: Talos Oblique RAT March 2021)","relationship_id":"relationship--483772af-6fc0-487b-aa3f-4006253708b3","references":[{"source_name":"Talos Oblique RAT March 2021","description":"Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021.","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"}]},{"id":"S0647","name":"Turian","url":"https://attack.mitre.org/software/S0647","kind":"malware","description":"[Turian](https://attack.mitre.org/software/S0647) can scan for removable media to collect data.(Citation: ESET BackdoorDiplomacy Jun 2021)","relationship_id":"relationship--f0a42be5-d7ec-475e-a9cd-2c4728153bb8","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","description":"Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) can identify peripheral devices on targeted systems.(Citation: Trend Micro Qakbot May 2020)","relationship_id":"relationship--add3bfcd-3e6d-4978-9e2c-ac6fad18fc5a","references":[{"source_name":"Trend Micro Qakbot May 2020","description":"Mendoza, E. et al. (2020, May 25). Qakbot Resurges, Spreads through VBS Files. Retrieved September 27, 2021.","url":"https://www.trendmicro.com/vinfo/ph/security/news/cybercrime-and-digital-threats/qakbot-resurges-spreads-through-vbs-files"}]},{"id":"S0673","name":"DarkWatchman","url":"https://attack.mitre.org/software/S0673","kind":"malware","description":"[DarkWatchman](https://attack.mitre.org/software/S0673) can list signed PnP drivers for smartcard readers.(Citation: Prevailion DarkWatchman 2021)","relationship_id":"relationship--ff2f9b25-f36a-4031-8013-1e746cc40948","references":[{"source_name":"Prevailion DarkWatchman 2021","description":"Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}]},{"id":"S0679","name":"Ferocious","url":"https://attack.mitre.org/software/S0679","kind":"malware","description":"[Ferocious](https://attack.mitre.org/software/S0679) can run <code>GET.WORKSPACE</code> in Microsoft Excel to check if a mouse is present.(Citation: Kaspersky WIRTE November 2021)","relationship_id":"relationship--6b15c0bd-7b39-408b-91fa-cf942a52a933","references":[{"source_name":"Kaspersky WIRTE November 2021","description":"Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}]},{"id":"S0686","name":"QuietSieve","url":"https://attack.mitre.org/software/S0686","kind":"malware","description":"[QuietSieve](https://attack.mitre.org/software/S0686) can identify and search removable drives for specific file name extensions.(Citation: Microsoft Actinium February 2022)","relationship_id":"relationship--adc3fbb4-955e-4861-ac19-4c2b546d562d","references":[{"source_name":"Microsoft Actinium February 2022","description":"Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022.","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"}]},{"id":"S1026","name":"Mongall","url":"https://attack.mitre.org/software/S1026","kind":"malware","description":"[Mongall](https://attack.mitre.org/software/S1026) can identify removable media attached to compromised hosts.(Citation: SentinelOne Aoqin Dragon June 2022)\n","relationship_id":"relationship--3146b7d3-26c9-47c4-b114-d39a4a786fc9","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","description":"Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"id":"S1027","name":"Heyoka Backdoor","url":"https://attack.mitre.org/software/S1027","kind":"malware","description":"[Heyoka Backdoor](https://attack.mitre.org/software/S1027) can identify removable media attached to victim's machines.(Citation: SentinelOne Aoqin Dragon June 2022)","relationship_id":"relationship--de727da1-d36f-4e33-99a1-05ce2df29094","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","description":"Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"id":"S1044","name":"FunnyDream","url":"https://attack.mitre.org/software/S1044","kind":"malware","description":"The [FunnyDream](https://attack.mitre.org/software/S1044) FilepakMonitor component can detect removable drive insertion.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--1555866c-1eca-4de3-aded-d745fdd47d1c","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1064","name":"SVCReady","url":"https://attack.mitre.org/software/S1064","kind":"malware","description":"[SVCReady](https://attack.mitre.org/software/S1064) can check for the number of devices plugged into an infected host.(Citation: HP SVCReady Jun 2022)","relationship_id":"relationship--69e4b520-6a9f-4dc0-b11e-805886ce8257","references":[{"source_name":"HP SVCReady Jun 2022","description":"Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.","url":"https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"}]},{"id":"S1089","name":"SharpDisco","url":"https://attack.mitre.org/software/S1089","kind":"malware","description":"[SharpDisco](https://attack.mitre.org/software/S1089) has dropped a plugin to monitor external drives to `C:\\Users\\Public\\It3.exe`.(Citation: MoustachedBouncer ESET August 2023)","relationship_id":"relationship--eeb5eeab-3fa1-4670-a7ab-f6a8f7193be9","references":[{"source_name":"MoustachedBouncer ESET August 2023","description":"Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"id":"S1090","name":"NightClub","url":"https://attack.mitre.org/software/S1090","kind":"malware","description":"[NightClub](https://attack.mitre.org/software/S1090) has the ability to monitor removable drives.(Citation: MoustachedBouncer ESET August 2023)","relationship_id":"relationship--c596d308-22af-45db-9c72-2ce1b3695f90","references":[{"source_name":"MoustachedBouncer ESET August 2023","description":"Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"id":"S1139","name":"INC Ransomware","url":"https://attack.mitre.org/software/S1139","kind":"malware","description":"[INC Ransomware](https://attack.mitre.org/software/S1139) can identify external USB and hard drives for encryption and printers to print ransom notes.(Citation: Cybereason INC Ransomware November 2023)","relationship_id":"relationship--0225c7c8-db18-469d-a1aa-566900e297a7","references":[{"source_name":"Cybereason INC Ransomware November 2023","description":"Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"}]},{"id":"S1149","name":"CHIMNEYSWEEP","url":"https://attack.mitre.org/software/S1149","kind":"malware","description":"[CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) can monitor for removable drives.(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--2afd76e6-335e-4769-8c2e-54b951753c2d","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1150","name":"ROADSWEEP","url":"https://attack.mitre.org/software/S1150","kind":"malware","description":"[ROADSWEEP](https://attack.mitre.org/software/S1150) can identify removable drives attached to the victim's machine.(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--bb60e296-c3d9-4363-992d-90f61607553a","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1167","name":"AcidPour","url":"https://attack.mitre.org/software/S1167","kind":"malware","description":"[AcidPour](https://attack.mitre.org/software/S1167) includes functionality to identify MMC and SD cards connected to the victim device.(Citation: SentinelOne AcidPour 2024)","relationship_id":"relationship--52cf6f18-15b4-4cfe-9044-92beb5fd72d8","references":[{"source_name":"SentinelOne AcidPour 2024","description":"Juan Andrés Guerrero-Saade & Tom Hegel. (2024, March 21). AcidPour | New Embedded Wiper Variant of AcidRain Appears in Ukraine. Retrieved November 25, 2024.","url":"https://www.sentinelone.com/labs/acidpour-new-embedded-wiper-variant-of-acidrain-appears-in-ukraine/"}]},{"id":"S1199","name":"LockBit 2.0","url":"https://attack.mitre.org/software/S1199","kind":"malware","description":"[LockBit 2.0](https://attack.mitre.org/software/S1199) has the ability to identify mounted external storage devices.(Citation: FBI Lockbit 2.0 FEB 2022)","relationship_id":"relationship--7aac169b-e8ff-47fe-8649-ea09929c6605","references":[{"source_name":"FBI Lockbit 2.0 FEB 2022","description":"FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}]},{"id":"S1202","name":"LockBit 3.0","url":"https://attack.mitre.org/software/S1202","kind":"malware","description":"[LockBit 3.0](https://attack.mitre.org/software/S1202) has the ability to discover external storage devices.(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)","relationship_id":"relationship--d6280c13-44e7-4046-bb53-a5f97cd25f43","references":[{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","description":"FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"}]},{"id":"S1230","name":"HIUPAN","url":"https://attack.mitre.org/software/S1230","kind":"malware","description":"[HIUPAN](https://attack.mitre.org/software/S1230) has checked periodically for removable drives and installs itself when a drive is detected.(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)","relationship_id":"relationship--edf938e4-8ea5-4be6-b4b4-68e00dfb14af","references":[{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","description":"Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","description":"Lenart Bermejo, Sunny Lu, Ted Lee. (2024, September 9). Earth Preta Evolves its Attacks with New Malware and Strategies. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"}]},{"id":"S9038","name":"DynoWiper","url":"https://attack.mitre.org/software/S9038","kind":"malware","description":"[DynoWiper](https://attack.mitre.org/software/S9038) has enumerated and overwritten files on all removeable and fixed drives.(Citation: ESET DynoWiper JAN 2026)  ","relationship_id":"relationship--a8bae6db-bf02-4e4e-93b0-140e8426b789","references":[{"source_name":"ESET DynoWiper JAN 2026","description":"ESET. (2026, January 30). Russian Sandworm group attacks energy company in Poland with DynoWiper, ESET Research discovers. Retrieved April 22, 2026.","url":"https://www.eset.com/us/about/newsroom/research/eset-research-russian-sandwormapt-attacks-energy-company-poland-with-dynowiper/"}]}],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) uses a module to receive a notification every time a USB mass storage device is inserted into a victim.(Citation: Microsoft SIR Vol 19)","relationship_id":"relationship--56d023cf-4390-40d9-afc6-cb0d40b4cdd1","references":[{"source_name":"Microsoft SIR Vol 19","description":"Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.","url":"http://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf"}]},{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) has used <code>fsutil fsinfo drives</code> to list connected drives.(Citation: ESET ComRAT May 2020)","relationship_id":"relationship--7dd2714d-aa8a-40ce-bae1-98634090ac01","references":[{"source_name":"ESET ComRAT May 2020","description":"Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"id":"G0020","name":"Equation","url":"https://attack.mitre.org/groups/G0020","kind":"intrusion-set","description":"[Equation](https://attack.mitre.org/groups/G0020) has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware.(Citation: Kaspersky Equation QA)","relationship_id":"relationship--062ebca3-abf7-449a-ad84-f04a3cada4dd","references":[{"source_name":"Kaspersky Equation QA","description":"Kaspersky Lab's Global Research and Analysis Team. (2015, February). Equation Group: Questions and Answers. Retrieved December 21, 2015.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) tools have contained an application to check performance of USB flash drives. [Gamaredon Group](https://attack.mitre.org/groups/G0047) has also used malware to scan for removable drives.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: ESET Gamaredon June 2020)(Citation: ESET Gamaredon Sept2024)","relationship_id":"relationship--d30d8fa0-7f24-41e5-ae8d-e4449e88d2f0","references":[{"source_name":"ESET Gamaredon June 2020","description":"Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source_name":"Palo Alto Gamaredon Feb 2017","description":"Kasza, A. and Reichel, D. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"},{"source_name":"ESET Gamaredon Sept2024","description":"Rusnák, Z. (2024, September 26). Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023. Retrieved October 30, 2024.","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has used tools to identify if a mouse is connected to a targeted system.(Citation: Check Point APT34 April 2021)","relationship_id":"relationship--8dd1ec07-e429-473d-84db-125fd22ab709","references":[{"source_name":"Check Point APT34 April 2021","description":"Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}]},{"id":"G0067","name":"APT37","url":"https://attack.mitre.org/groups/G0067","kind":"intrusion-set","description":"[APT37](https://attack.mitre.org/groups/G0067) has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices. (Citation: Securelist ScarCruft May 2019)","relationship_id":"relationship--09c8ec4f-c76b-4a36-994f-4ed4d87b7ad8","references":[{"source_name":"Securelist ScarCruft May 2019","description":"GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.","url":"https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"}]},{"id":"G0135","name":"BackdoorDiplomacy","url":"https://attack.mitre.org/groups/G0135","kind":"intrusion-set","description":"[BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) has used an executable to detect removable media, such as USB flash drives.(Citation: ESET BackdoorDiplomacy Jun 2021)","relationship_id":"relationship--d758de81-c572-45dc-94ed-67a4dc1da3fe","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","description":"Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has searched for attached VGA devices using lspci.(Citation: Cisco Talos Intelligence Group)","relationship_id":"relationship--be8f7d93-1de8-4376-bec9-4db0a15f7542","references":[{"source_name":"Cisco Talos Intelligence Group","description":"Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has obtained victim's screen dimension and display device information.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--c1632c73-7043-4aef-89f6-abbf6af676d2","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]}],"mitigations":[],"candidates":[{"id":"2cb4dbf2-2dca-4597-8678-4d39d207a3a5","name":"Win32_PnPEntity Hardware Inventory","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1120/T1120.yaml","description":"Perform peripheral device discovery using Get-WMIObject Win32_PnPEntity","inputs":{},"dependencies":[],"source_definition_sha256":"afa1316ba4b491f72884bf7ec9796e8b9961a4660a2d75bfc1d72f4708bf3c73"},{"id":"424e18fd-48b8-4201-8d3a-bf591523a686","name":"Peripheral Device Discovery via fsutil","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1120/T1120.yaml","description":"Performs pheripheral device discovery utilizing fsutil to list all drives.","inputs":{},"dependencies":[],"source_definition_sha256":"5089f71780e37182acaaa91e34da8659d253e72060e27dab49bd24c79faaa018"},{"id":"5c876daf-db1e-41cf-988d-139a7443ccd4","name":"Get Printer Device List via PowerShell Command","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1120/T1120.yaml","description":"This test uses PowerShell to list printers on a Windows system, demonstrating a discovery technique attackers might use to \ngather details on connected devices. Using Get-Printer, they can view information on all available printers, identifying \npotential devices for further targeting.\n","inputs":{},"dependencies":[],"source_definition_sha256":"6d28e20a01be3cfb1e00dd13b0a51adfacc0f2816fa70dfe9d43082f42180542"},{"id":"cb6e76ca-861e-4a7f-be08-564caa3e6f75","name":"WinPwn - printercheck","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1120/T1120.yaml","description":"Search for printers / potential vulns using printercheck function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"4e6e8d94fc40fb3202dfc6295445012994576e6bb42ee99fde9a5a8bdc2bcddd"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1120":"/ttp-simulation/techniques/enterprise/T1120/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1120","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0054","collector":"illustrative-lab-collector","observation":{"device_path":"\\\\.\\PhysicalDrive2","process_id":4200,"action":"raw_read"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}