T1120 — Peripheral Device Discovery

Tactic: Discovery · Platforms: Linux, macOS, Windows

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable…

Sigma detection rules (3)

T1120 Peripheral Device Discovery

title: T1120 Peripheral Device Discovery
id: 83638c75-a52c-4982-b2e1-be8c2c8c6b2e
description: 'Detects driverquery.exe or PnP/WMI enumeration cmdlets used to enumerate peripheral devices. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: CommandLineRegex, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1120
author: Shahrukh Khan
date: 2026-04-27
license: MIT
tags:
  - attack.discovery
  - attack.t1120

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_driverquery:
    EventID: '1'
    Image|endswith: '\driverquery.exe'
  selection_pnp_cmdlet:
    EventID: '1'
    CommandLine|contains:
      - 'Get-PnpDevice'
      - 'Win32_PnPEntity'
      - 'Get-CimInstance Win32_PnPEntity'
      - 'Get-WmiObject Win32_PnPEntity'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (selection_driverquery or selection_pnp_cmdlet) and not filter_system_account

falsepositives:
  - IT asset-inventory scripts.

level: medium

T1120 Peripheral Device Discovery

title: T1120 Peripheral Device Discovery
id: e56191f3-1c2b-460d-a96c-2cafbf88bc8a
description: 'Peripheral Device Enumeration via System Utilities and API Calls. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutableList, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1120
author: Shahrukh Khan
date: 2026-02-20
license: MIT
tags:
  - attack.discovery
  - attack.t1120

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/lsusb'
      - '/lspci'
      - '/lshw'

  condition: selection

falsepositives:
  - lsusb/lspci/lshw are routine hardware-inventory commands run by admins and asset-management agents.

level: informational

T1120 Peripheral Device Discovery

title: T1120 Peripheral Device Discovery
id: ed1b2ddc-62b0-4771-98be-d108db6d0890
description: 'Peripheral Device Enumeration via System Utilities and API Calls. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: BinaryList, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1120
author: Shahrukh Khan
date: 2026-06-18
license: MIT
tags:
  - attack.discovery
  - attack.t1120

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/system_profiler'
    CommandLine|contains: 'SPUSBDataType'

  condition: selection

falsepositives:
  - IT inventory and asset-management agents routinely query USB peripheral information this way.

level: informational

Explore