T1200 — Hardware Additions

Tactic: Initial Access · Platforms: Windows, Linux, macOS

Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media),…

Sigma detection rules (3)

T1200 Hardware Additions

title: T1200 Hardware Additions
id: fc9f7af2-da56-4541-b6c6-99f7d45a2eb9
description: 'Detect unauthorized Hardware Additions via Security EventID 6416 (new external device recognized by PnP). Requires Audit PNP Activity policy. (Data Component: Peripheral Device Connection; baseline tier: windows-eventid.) Tune using: TrustedDeviceVIDPID, ExpectedBusTypes, TimeWindow, TrustedMACs.'
references:
  - https://attack.mitre.org/techniques/T1200
author: Shahrukh Khan
date: 2026-01-07
license: MIT
tags:
  - attack.initial-access
  - attack.t1200

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: '6416'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Routine hardware connections.

level: medium

T1200 Hardware Additions

title: T1200 Hardware Additions
id: a40ee110-55ec-41a3-92f0-96f8af948cbb
description: 'Detect unauthorized or suspicious Hardware Additions (USB/Thunderbolt/Network). The previous version watched CONFIG_CHANGE/add_rule, which is auditd''s own audit-rule modification event and has no relationship to physical hardware being attached. Retargeted to auditd PATH CREATE events under /dev/bus/usb/ (the device nodes udev creates the moment a new USB device enumerates), which requires an explicit audit watch rule (-w /dev/bus/usb -p wa -k hw_add) to be configured -- auditd has no default/native visibility into hardware enumeration otherwise. Kernel dmesg/journald USB-attach log lines remain a useful complementary source outside of auditd. Tune using: BlocklistDeviceStrings, ServerClassesNoUSB, DHCPVlanScopes.'
references:
  - https://attack.mitre.org/techniques/T1200
author: Shahrukh Khan
date: 2026-04-13
license: MIT
tags:
  - attack.initial-access
  - attack.t1200

logsource:
  category: file_change
  product: linux
  service: auditd

detection:
  selection:
    type: PATH
    name|contains: '/dev/bus/usb/'
    nametype: CREATE

  condition: selection

falsepositives:
  - Authorized use of USB keyboards/mice/storage or approved peripherals creates the same /dev/bus/usb/ device nodes; this rule requires an explicit audit watch on /dev/bus/usb (not present by default) and should be paired with an approved-device allowlist. Network-tap and Thunderbolt-based hardware additions are not covered by this USB-focused proxy at all.

level: low

T1200 Hardware Additions

title: T1200 Hardware Additions
id: 7a487918-aae2-468e-8c59-b294e99b1426
description: 'Detect unauthorized or suspicious Hardware Additions (USB/Thunderbolt/Network). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ManagedUSBPolicy, KnownAppleAccessories.'
references:
  - https://attack.mitre.org/techniques/T1200
author: Shahrukh Khan
date: 2026-05-09
license: MIT
tags:
  - attack.initial-access
  - attack.t1200

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/system_profiler'
    CommandLine|contains: 'SPUSBDataType'

  condition: selection

falsepositives:
  - Routine USB inventory scans by IT tooling, or normal reconnect patterns of the same accessory during everyday use.

level: informational

Explore