Malware that asks which USB drives, Bluetooth devices and disks are attached is usually deciding what to steal, what to encrypt or where to spread next, and that question leaves traces defenders rarely collect. MITRE ATT&CK T1120 Peripheral Device Discovery covers gathering information about peripheral devices and components connected to a system, such as keyboards, printers, cameras, smart card readers and removable storage. ATT&CK v20 maps it on Windows, Linux and macOS, records espionage groups and ransomware using it, and maps no preventive mitigation. This guide shows how the technique appears in real intrusions, which telemetry from the ATT&CK v20 detection strategy catches it, and how device control and logging turn it into a useful early signal before removable media theft or replication. It is written for detection engineers and endpoint teams and contains no attack procedures.
Key takeaways
- Enumeration is the prelude. Peripheral discovery usually precedes collection from removable media (T1025), exfiltration over USB (T1052.001) or replication through removable media (T1091).
- Context decides. Device Manager, printer drivers and inventory agents enumerate devices constantly; a script host or an unsigned process doing it, then touching files or the network, is the pattern in ATT&CK v20 detection strategy DET0491.
- Collect device events you already have. Windows event 6416 under Audit PNP Activity records every new external device, and Linux and macOS can report USB events through osquery tables named in DET0491.
- Device control shrinks the target. Allowlisting device classes and IDs with Device Installation Restrictions means discovered devices cannot become exfiltration channels.
- Drivers are a separate step. Listing loaded drivers to find a vulnerable one is T1652 Device Driver Discovery, a separate technique that precedes vulnerable driver loading.
What the technique covers
ATT&CK v20 describes T1120 as an adversary attempting to gather information about attached peripheral devices and components connected to a computer system, which may include auxiliary resources that support a variety of functionality, such as keyboards, printers, cameras, smart card readers or removable storage, and notes that the information may improve the adversary's awareness of the system and network or support further actions. It has no sub-techniques. Related but separate IDs: T1680 Local Storage Discovery for drives and volumes, and T1652 Device Driver Discovery for loaded drivers, which is the usual precursor to loading a vulnerable driver (see the Bring Your Own Vulnerable Driver and EDR Killers Guide).
| Platform (v20) | Interfaces named in DET0491 | Typical legitimate users |
|---|---|---|
| Windows | WMI and PowerShell device queries (for example Get-PnpDevice, Win32_USBController), low-level device APIs | Device Manager, printer and scanner software, endpoint management inventory, EDR |
| Linux | lsusb, lshw, udevadm, reads under /sys and /proc | udev rules, hardware monitoring, configuration management facts |
| macOS | system_profiler SPUSBDataType, ioreg -p IOUSB | System Information, MDM inventory, device management agents |
How adversaries use it: real cases
The examples below are procedure entries in the ATT&CK v20 data, with the sources ATT&CK cites.
| Group or software | Recorded behaviour | Why it mattered |
|---|---|---|
| APT28 | A module that is notified every time a USB mass storage device is inserted (Microsoft Security Intelligence Report) | Reaching removable media, including media that crosses into isolated networks |
| APT37 | A Bluetooth device harvester that uses Windows Bluetooth APIs to collect information on connected devices (Kaspersky Securelist) | Profiling the victim's devices and surroundings |
| Gamaredon Group | Tools that check USB flash drives and malware that scans for removable drives (ESET) | Spreading through and collecting from removable media |
| LockBit 2.0 | Identifies mounted external storage devices (FBI flash, February 2022) | Extending encryption to attached storage; the same flash lists local drive layout and remote shares among collected details |
| Equation | Tools that gather information about the attached hard drive to identify and overwrite firmware (Kaspersky) | Selecting a firmware implant for the exact disk model |
| Volt Typhoon | Obtained screen dimension and display device information (CISA AA24-038A) | Host profiling during long-term access to critical infrastructure. See the Volt Typhoon Threat Actor Profile. |
| TeamTNT | Searched for attached VGA devices using lspci (Cisco Talos) | Checking for GPUs worth using for cryptomining |
The same LockBit 2.0 flash describes the ransomware checking system and user language settings and exiting on a list of languages; that check is a different technique, T1614 System Location Discovery.
What to detect and where
ATT&CK v20 detection strategy DET0491 "Peripheral Device Enumeration via System Utilities and API Calls" looks for enumeration in proximity to follow-on activity: removable device interaction, file collection, clipboard capture or network transfer. The log sources below are from DET0491 and Microsoft documentation; the detection ideas are NHI Mgmt Group recommendations.
| Platform | Log source | Detection idea |
|---|---|---|
| Windows | Security 4688 or Sysmon 1 (process creation); Sysmon 10 (process access), as named in DET0491 | Device enumeration by script hosts, Office applications or unsigned binaries, followed within minutes by reads from a removable drive letter or an archive written to it |
| Windows | Event 6416 "A new external device was recognized by the System" (Audit PNP Activity) | Inventory of every device connected; Microsoft recommends reporting the event whenever the subject is not SYSTEM. Track Device ID, Class Name, Class ID, Vendor IDs (hardware IDs) and Compatible IDs |
| Linux | auditd execve and file reads; osquery hardware_events | lsusb, lshw or udevadm run by service accounts or from web and container processes, followed by mount activity |
| macOS | Unified log process execution; osquery usb_devices | system_profiler or ioreg USB queries by scripts, followed by clipboard, file or network activity |
Cutting the noise
- Baseline device queries: endpoint management, MDM, printer software, hardware monitoring and EDR all enumerate devices. Exclude by signer and parent process, not by command.
- Join with removable media activity: enumeration alone is low value; enumeration followed by a removable drive mount, bulk file copy or archive creation is high value.
- Prioritise servers: peripheral queries on servers, especially virtual machines with no USB devices in normal use, are rare and worth an alert.
- Use device events as context: a new mass storage device recognised (6416) on a host where device enumeration just ran by an unusual process should raise severity.
Prevention and hardening
ATT&CK v20 maps no mitigations to T1120: an operating system has to describe its hardware to software. The controls below are NHI Mgmt Group recommendations that limit what discovered devices can be used for and make device activity visible.
| Control | Setting or mechanism | Effect |
|---|---|---|
| Device installation allowlisting | Group Policy under Computer Configuration, Administrative Templates, System, Device Installation, Device Installation Restrictions: "Allow installation of devices that match any of these device IDs", "Prevent installation of devices using drivers that match these device setup classes", and "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" | Only approved device classes and IDs can be installed, so unapproved storage cannot become an exfiltration path |
| Removable storage control | Block or set read-only for removable storage by default, with exceptions for approved encrypted devices | Limits T1052.001 and T1091. See the Removable Media and USB Control Guide. |
| Audit policy | Enable Audit PNP Activity (event 6416) and, where file access on removable media matters, Audit Removable Storage | Gives a reliable device inventory and timeline |
| Application control | Restrict script hosts and unsigned binaries on standard endpoints and servers | Fewer processes able to run enumeration. See the App Control for Business (WDAC) guide. |
| Endpoint DLP | Policies for copying sensitive content to removable media | Catches the collection step that follows discovery. See the Endpoint DLP Guide. |
| Server and VM hardening | Remove USB controllers and passthrough from virtual machines that do not need them | Nothing to discover or use on the server tier |
Rolling out device control
- Inventory: enable Audit PNP Activity on a pilot ring and collect 6416 events for several weeks to learn which device classes and IDs are really in use.
- Define the allowlist: keyboards, mice, approved headsets and docking stations, smart card readers and approved encrypted storage by device ID.
- Pilot: apply the allow and prevent policies with layered evaluation to the pilot ring and track help desk tickets.
- Expand by ring: move to wider workstation groups, then to servers, where the allowlist should be close to empty.
- Roll back: remove the policy from the affected ring and confirm affected devices install again; test on devices that were already installed before the policy, as well as on new ones.
Small and large organisations
A small organisation should block unapproved removable storage, enable 6416 auditing and alert on mass storage use on servers. A large organisation adds DET0491 analytics per platform, endpoint DLP for removable media, MDM or osquery USB inventory on macOS and Linux, and regular reports on unexpected device classes by business unit.
How to test your coverage
- Emulate safely: on an approved test host, run built-in device enumeration from a script host and from an unusual parent, using an authorised framework such as Atomic Red Team tests mapped to T1120.
- Confirm telemetry: verify process creation with command line, 6416 events and osquery USB events reach the SIEM.
- Test the chain: connect an approved test drive after the enumeration and confirm the correlation rule fires.
- Test prevention: connect an unapproved storage device and confirm installation is blocked and logged.
- Record results: update your ATT&CK coverage map and remove any temporary exclusions.
Metrics
- Audit coverage: share of endpoints and servers sending 6416 or equivalent USB events.
- Device control coverage: share of endpoints with Device Installation Restrictions enforced.
- Unexpected devices: count of new mass storage devices recognised on servers per month, trending to zero.
- Precision: share of enumeration alerts closed as known tooling.
Related discovery techniques: T1082 System Information Discovery, T1083 File and Directory Discovery and T1680 Local Storage Discovery.
Framework mapping
| Framework | Relevant items |
|---|---|
| MITRE ATT&CK v20 | TA0007 Discovery; T1120; related T1680, T1652, T1614; follow-on T1025, T1052.001, T1091 |
| ATT&CK detection | DET0491 Peripheral Device Enumeration via System Utilities and API Calls |
| MITRE D3FEND | D3-HCI Hardware Component Inventory, D3-PSA Process Spawn Analysis |
| NIST SP 800-53 Rev. 5 | MP-7 Media Use, CM-8 System Component Inventory, AU-12 Audit Record Generation, SI-4 System Monitoring |
| NIST CSF 2.0 | ID.AM-01 (hardware inventories maintained), DE.CM-09 (computing hardware and software monitored), PR.PS-01 (configuration management applied) |
| CIS Controls v8.1 | Control 1 Inventory and Control of Enterprise Assets, Control 10 Malware Defenses (autorun and removable media scanning) |
Practitioner checklist
- Enable Audit PNP Activity and collect event 6416 from endpoints and servers.
- Collect USB inventory on macOS and Linux through osquery or your EDR.
- Alert on device enumeration by script hosts and unsigned processes, joined with removable media activity.
- Treat any mass storage device recognised on a server as an incident lead.
- Enforce Device Installation Restrictions with an allowlist and layered evaluation.
- Block or set read-only for removable storage by default, with approved encrypted exceptions.
- Remove USB controllers from virtual machines that do not need them.
- Test the analytics and device control each quarter and record the result.
Standards and references
- MITRE ATT&CK: Peripheral Device Discovery (T1120)
- MITRE ATT&CK: Exfiltration over USB (T1052.001)
- Microsoft Learn: 6416 A new external device was recognized by the System
- Microsoft Learn: Manage device installation with Group Policy
- FBI: LockBit 2.0 indicators of compromise flash
- MITRE D3FEND: Hardware Component Inventory
Related NHI Mgmt Group resources: Discovery and Reconnaissance Techniques Guide · Removable Media and USB Control Guide · Bring Your Own Vulnerable Driver and EDR Killers Guide · USB Drop Attacks Guide