Hardware Additions T1200
Tactic: Initial Access
Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.
Events covered
10 catalog events are tagged with this technique by at least one rule.
Authoring guide
These 15 rules share fields, values, and exclusions.
Fields filtered most (17 distinct)
These fields appear most often in rule filters.
Top indicator values (37 distinct)
These values appear most often in rule predicates.
Exclusions (2 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 3 rules
- Device Installation Blocked
- External Disk Drive Or USB Storage Device Was Recognized By The System
- USB Device Plugged
Splunk 10 rules
- Detect ARP Poisoning
- Detect IPv6 Network Infrastructure Threats
- Detect Port Security Violation
- Detect Rogue DHCP Server
- Detect Traffic Mirroring
- Linux Auditd Hardware Addition Swapoff
- Linux Hardware Addition SwapOff
- Windows Process Executed From Removable Media
- Windows USBSTOR Registry Key Modification
- Windows WPDBusEnum Registry Key Modification