MITRE ATT&CK T1200 Hardware Additions: Detecting and Blocking Rogue Devices

A cheap computer hidden under a meeting room table, with its own mobile modem, can give an attacker a foothold on your internal network that never touches your firewall or your email filter. MITRE ATT&CK T1200 Hardware Additions covers adversaries physically introducing computer accessories, networking hardware or other computing devices into a system or network as a way in. ATT&CK v20 places it under Initial Access (TA0001) on Windows, Linux and macOS, maps two mitigations (M1034 Limit Hardware Installation and M1035 Limit Access to Resource Over Network) and one detection strategy, DET0069. This guide covers the technique view: the recorded case, the telemetry that catches a new device, the controls that stop an unknown device from being useful, and how to test them. It is written for detection engineers, network and endpoint teams, and contains no attack procedures. For DMA and Thunderbolt hardening in depth, see the Thunderbolt, DMA and Peripheral Attack Protection Guide.

Key takeaways

• Two attack surfaces, one technique. T1200 covers devices plugged into a host (keystroke injectors, DMA-capable PCIe devices) and devices plugged into the network (small computers, taps, rogue access points).
• The network port is the bigger gap. In the recorded DarkVishnya intrusions against banks, the devices were full computers on the LAN with their own cellular uplink, so perimeter controls never saw the command channel.
• Every legitimate device should have an identity. 802.1X with device certificates and DHCP restricted to registered devices (M1035) turns "plugged in" into "not authenticated", which is the control that defeats a rogue computer.
• Host telemetry already exists. Windows event 6416 under Audit PNP Activity records every new external device; DET0069 chains it with new volumes, driver loads and new MAC addresses on DHCP.
• The hardware is only the entry. What follows is discovery, credential theft and remote service execution, so detection must join the new device with the activity it originates.

What the technique covers

ATT&CK v20 describes T1200 as adversaries physically introducing computer accessories, networking hardware or other computing devices into a system or network to gain access, and contrasts it with simply distributing payloads on removable storage, which is T1091 Replication Through Removable Media. The ATT&CK entry notes that public reporting of threat actor use is scarce while red teams use hardware additions often, and lists capabilities such as passive network tapping, traffic modification (T1557 Adversary-in-the-Middle), keystroke injection, kernel memory reading via DMA and adding wireless access points to an existing network. T1200 has no sub-techniques. The attack page on ATT&CK shows version 1.7, last modified 24 October 2025.

How adversaries use it: the recorded case

ATT&CK v20 has a single procedure example: DarkVishnya (G0105), which physically connected Bash Bunny devices, Raspberry Pi computers, netbooks and inexpensive laptops to target organisations' networks. Kaspersky's Securelist report on the group, cited by ATT&CK, describes attacks on at least eight banks in Eastern Europe with damage estimated in the tens of millions of dollars. The report's account is useful because each stage maps to a control:

1. Placement: the device was connected in the central office or a regional office, sometimes in another country, for example in a meeting room, hidden where possible.
2. Out-of-band command channel: remote access came through a built-in or USB-connected GPRS, 3G or LTE modem, so no traffic crossed the corporate perimeter. Where firewalls blocked one segment from another but allowed reverse connections, the operators built tunnels.
3. Discovery: they scanned the internal network for open shared folders, web servers and other open resources, focusing on servers and workstations used for payments.
4. Credential access: they tried to brute-force or sniff login data for those machines.
5. Execution and persistence: they logged in, installed remote access software and started malicious services, relied on PowerShell and fileless techniques, and fell back to Impacket, winexesvc.exe or psexec.exe to run executables remotely when blocked.

The lesson for defenders: the hardware stage lasts minutes and the rest of the intrusion uses ordinary lateral movement (T1021.002 SMB/Windows Admin Shares, T1569.002 Service Execution). A device with no network identity, talking to payment servers, is the anomaly to catch. The response steps for a found device are in the Rogue Device on Network Playbook.

What to detect and where

ATT&CK v20 detection strategy DET0069 "Detect unauthorized or suspicious Hardware Additions (USB/Thunderbolt/Network)" has three analytics, each a chain: a new device is recognised, then within a short window the same session spawns processes or the operating system mounts a new volume, optionally followed by keystroke injection, a DMA driver load or a new network interface MAC obtaining a DHCP lease. The log sources below are those DET0069 names; the detection ideas are NHI Mgmt Group recommendations.

Using event 6416 well

Event 6416 "A new external device was recognized by the System" is generated every time a new external device is connected or enabled, under the Audit PNP Activity subcategory (Windows 10 and Windows Server 2016 onwards). Version 1 of the event added the Device ID, Device Name and Class Name fields. Microsoft recommends reporting the event whenever the Subject Security ID is not SYSTEM, and tracking the Device ID, Class ID, Vendor IDs (hardware IDs), Compatible IDs and Location Information fields. Practical rules built on it:

• Keyboard on a server: a new Keyboard or HIDClass device on a server or kiosk is rare and worth a high-severity alert.
• Second keyboard: a new keyboard on a laptop that already has one, followed by a shell launched within seconds, is the keystroke injection pattern.
• Unknown vendor IDs: keep a list of approved hardware IDs from your device fleet and alert on new values by business unit.
• New network adapters: a new Net-class device (USB Ethernet or cellular modem) on an endpoint can be an out-of-band channel like the one DarkVishnya used.

Network-side detection

1. Reconcile DHCP with inventory: every lease should match a known asset; unknown MAC addresses on user VLANs are leads, and on server VLANs are incidents.
2. Watch port state: alert when a port that has been unused for weeks comes up, especially in meeting rooms, reception areas and remote offices.
3. Use NAC results: repeated 802.1X failures or MAC Authentication Bypass use on a port that normally carries a certificate-authenticated laptop deserve review.
4. Find the internal scanner: a new host that starts connecting to many internal addresses on SMB, RDP and web ports within its first hour matches the discovery stage of the DarkVishnya case.

Mitigations and hardening

ATT&CK v20 maps two mitigations to T1200. M1034 Limit Hardware Installation: block unknown devices and accessories by endpoint security configuration and monitoring agent. M1035 Limit Access to Resource Over Network: establish network access control policies, such as device certificates and the 802.1X standard, and restrict DHCP to registered devices so unregistered devices cannot communicate with trusted systems. The settings below are how to apply them; items not in the ATT&CK entry are NHI Mgmt Group recommendations.

Points that catch teams out

• Retroactive blocking: Microsoft's device installation guidance warns that the "also apply to matching devices that are already installed" option can block crucial devices, for example the boot disk if all Disk Drives are blocked, or network access if all Net devices are blocked. Use it only after testing.
• Parent devices: blocking a USB hub or host controller blocks everything beneath it, including the keyboard and mouse. Allow the hubs and controllers your fleet uses.
• Kernel DMA Protection defaults: the default for incompatible devices is "Allowed only after user sign-in"; such a device then keeps working until reboot or unplug, even if the screen is later locked. Kernel DMA Protection does not cover FireWire, PCMCIA, CardBus or ExpressCard, and does not protect during boot, which is the firmware's job. Check the Kernel DMA Protection field in msinfo32.
• MAC Authentication Bypass: printers, phones and cameras that cannot do 802.1X are often admitted by MAC address, which a small computer can copy. Put MAB devices in restricted VLANs that only reach their own servers.

Where identity fits

The control that defeats a rogue computer is an identity check on the device itself. Device certificates for 802.1X are machine identities with the same lifecycle problems as any other non-human identity: they need an owner, a short validity, automated renewal and revocation when the device is retired. A certificate copied from a decommissioned laptop, or a shared certificate deployed to many printers, lets a rogue device authenticate. Once on the network, the DarkVishnya operators went after credentials and used remote service execution, so service accounts with broad local administrator rights on payment servers made the hardware foothold far more valuable. See the Machine Identity, PKI and Certificate Lifecycle Guide and the 802.1X and EAP-TLS Enterprise Wi-Fi Guide.

Rolling out the controls

1. Inventory first: enable Audit PNP Activity on a pilot ring, collect 6416 and DHCP lease data for several weeks, and reconcile MAC addresses and hardware IDs against the asset register.
2. Close the easy gaps: shut unused switch ports, move meeting room and reception ports to a guest or quarantine VLAN, and enable Kernel DMA Protection where the firmware supports it.
3. 802.1X in monitor mode: turn on port authentication in a monitor or open mode so failures are logged but not enforced, and fix the devices that fail.
4. Enforce by site: enforce 802.1X site by site, starting with head office floors, then regional offices, which were the placement points in the recorded case.
5. Endpoint device control: pilot device installation allowlists with layered evaluation, then widen by ring.
6. Roll back: keep a per-port and per-site switch back to monitor mode, and remove device installation policy from a ring if critical peripherals stop working; test that devices reinstall after removal.

Small and large organisations

A small organisation with one office can get most of the value from disabled unused ports, a guest VLAN for meeting rooms, DHCP reservations and alerts on unknown MAC addresses. A large or branch-heavy organisation needs 802.1X with device certificates everywhere, NAC-driven VLAN assignment, central collection of 6416 and DHCP logs, and wireless intrusion detection in every building.

How to test your coverage

1. Authorised physical test: under a signed scope, have a red team or physical tester attempt to connect an unregistered small computer in a meeting room and a branch office.
2. Measure time to detect: record how long until the unknown MAC, port state change or NAC failure produced an alert, and whether the device reached any server VLAN.
3. Test endpoint controls: connect an unapproved USB network adapter and a second keyboard on a test laptop and confirm installation is blocked or 6416 alerts fire.
4. Check DMA protection: confirm the Kernel DMA Protection field reads ON across the fleet through inventory, not spot checks.
5. Record results: update the ATT&CK coverage map for T1200 and track fixes to closure.

Metrics

• Port authentication coverage: share of active access ports enforcing 802.1X, by site.
• Unknown device dwell time: median time from an unknown MAC obtaining a lease to an analyst reviewing it.
• Inventory match rate: share of DHCP leases matching the asset register.
• DMA protection coverage: share of laptops reporting Kernel DMA Protection ON.
• Device control coverage: share of Windows endpoints with device installation restrictions enforced.

Framework mapping

Practitioner checklist

• Enable Audit PNP Activity and collect event 6416 centrally; alert on new HID and Net-class devices on servers.
• Reconcile DHCP leases against the asset inventory daily and alert on unknown MAC addresses on server VLANs.
• Disable unused switch ports and put meeting room and reception ports in a restricted VLAN.
• Enforce 802.1X with device certificates, and keep MAC Authentication Bypass devices in isolated VLANs.
• Manage 802.1X device certificates as machine identities: owner, renewal and revocation at retirement.
• Enable Kernel DMA Protection and decide the enumeration policy for incompatible devices.
• Apply device installation allowlists with layered evaluation after a pilot.
• Run an authorised physical test at least once a year, including a branch office.

Standards and references

• MITRE ATT&CK: Hardware Additions (T1200)
• MITRE ATT&CK: DarkVishnya (G0105)
• Kaspersky Securelist: DarkVishnya, banks attacked through direct connection to local network
• Microsoft Learn: 6416 A new external device was recognized by the System
• Microsoft Learn: Manage device installation with Group Policy
• Microsoft Learn: Kernel DMA Protection
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: ATT&CK Initial Access Tactic · Rogue Device on Network Playbook · M1035 Limit Access to Resource Over Network · USB Drop Attacks Guide · CWE Hardware Weaknesses Guide