Peripheral Device Discovery `T1120`

Tactic: Discovery

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.

Events covered

3 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Security-Auditing	Event ID 4688	A new process has been created.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).

Authoring guide

These 5 rules share fields, values, and exclusions.

Fields filtered most (11 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`OriginalFileName`	2	`eq` 2	`fsutil.exe`
`ScriptBlockText`	2	`contains` 1, `eq` 1, `in` 1	`get-audiodevice`, `get-microphoneaudio`, `mcisendstring`, `win32_pnpentity`
`CommandLine`	1	`contains` 1	`drives`
`EventID`	1	`eq` 1	`4688`
`Image`	1	`ends_with` 1	`\fsutil.exe`
`Type`	1	`eq` 1
`event.category`	1	`eq` 1	`process`
`event.type`	1	`eq` 1	`start`
`host.os.type`	1	`eq` 1
`process.args`	1	`eq` 1	`drives`, `fsinfo`
`process_name`	1	`eq` 1	`fsutil.exe`

Top indicator values (22 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`OriginalFileName`	`eq`	`fsutil.exe` sigmaFsutil Drive Enumeration elasticPeripheral Device Discovery	2	6
`CommandLine`	`contains`	`drives` sigmaFsutil Drive Enumeration	1
`EventID`	`eq`	`4688` splunkFsutil fsinfo execution (Windows Event Log)	1	317
`Image`	`ends_with`	`\fsutil.exe` sigmaFsutil Drive Enumeration	1	5
`ScriptBlockText`	`contains`	`win32_pnpentity` sigmaPowershell Suspicious Win32_PnPEntity	1
`ScriptBlockText`	`eq`	`get-audiodevice` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`eq`	`get-microphoneaudio` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`eq`	`recording` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`eq`	`set-audiodevice` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`eq`	`windowsaudiodevice-powershell-cmdlet` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`eq`	`winmm.dll` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`in`	`mcisendstring` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`in`	`mcisendstringa` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`in`	`mcisendstringw` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`in`	`waveingetnumdevs` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`in`	`waveinopen` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`in`	`waveinstart` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`event.category`	`eq`	`process` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1	142
`event.type`	`eq`	`start` elasticPeripheral Device Discovery	1	1078
`process.args`	`eq`	`drives` elasticPeripheral Device Discovery	1
`process.args`	`eq`	`fsinfo` elasticPeripheral Device Discovery	1
`process_name`	`eq`	`fsutil.exe` elasticPeripheral Device Discovery	1	7

Exclusions (3 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`ScriptBlockText`	`eq`	`powersploitindicators` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`eq`	`sentinelbreakpoints` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`eq`	`set-psbreakpoint` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Windows

Domain: Endpoint

Sigma 2 rules

Elastic 2 rules

Splunk 1 rule

Fsutil fsinfo execution (Windows Event Log)

Peripheral Device Discovery T1120