Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.[1][2] Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
ID | Name | Description |
---|---|---|
S0045 | ADVSTORESHELL |
ADVSTORESHELL can list connected devices.[3] |
G0007 | APT28 |
APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim.[4] |
G0067 | APT37 |
APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices. [5] |
S0438 | Attor |
Attor has a plugin that collects information about inserted storage devices, modems, and phone devices.[6] |
G0135 | BackdoorDiplomacy |
BackdoorDiplomacy has used an executable to detect removable media, such as USB flash drives.[7] |
S0128 | BADNEWS |
BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.[8][9] |
S0234 | Bandook | |
S0089 | BlackEnergy |
BlackEnergy can gather very specific information about attached USB devices, to include device instance ID and drive geometry.[11] |
S0454 | Cadelspy |
Cadelspy has the ability to steal information about printers and the documents sent to printers.[12] |
S0115 | Crimson |
Crimson has the ability to discover pluggable/removable drives to extract files from.[13][14] |
S0538 | Crutch |
Crutch can monitor for removable drives being plugged into the compromised machine.[15] |
S0673 | DarkWatchman |
DarkWatchman can list signed PnP drivers for smartcard readers.[16] |
S0062 | DustySky | |
G0020 | Equation |
Equation has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware.[18] |
S0679 | Ferocious |
Ferocious can run |
S0381 | FlawedAmmyy |
FlawedAmmyy will attempt to detect if a usable smart card is current inserted into a card reader.[20] |
S1044 | FunnyDream |
The FunnyDream FilepakMonitor component can detect removable drive insertion.[21] |
G0047 | Gamaredon Group |
Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.[22][23] |
S1027 | Heyoka Backdoor |
Heyoka Backdoor can identify removable media attached to victim's machines.[24] |
S0283 | jRAT | |
S0409 | Machete |
Machete detects the insertion of new devices by listening for the WM_DEVICECHANGE window message.[26] |
S1026 | Mongall |
Mongall can identify removable media attached to compromised hosts.[24] |
S0149 | MoonWind |
MoonWind obtains the number of removable drives from the victim.[27] |
S1090 | NightClub | |
S0385 | njRAT |
njRAT will attempt to detect if the victim system has a camera during the initial infection. njRAT can also detect any removable drives connected to the system.[29][30] |
S0644 | ObliqueRAT |
ObliqueRAT can discover pluggable/removable drives to extract files from.[31] |
G0049 | OilRig |
OilRig has used tools to identify if a mouse is connected to a targeted system.[32] |
C0012 | Operation CuckooBees |
During Operation CuckooBees, the threat actors used the |
C0014 | Operation Wocao |
During Operation Wocao, threat actors discovered removable disks attached to a system.[34] |
S0113 | Prikormka |
A module in Prikormka collects information on available printers and disk drives.[35] |
S0650 | QakBot |
QakBot can identify peripheral devices on targeted systems.[36] |
S0686 | QuietSieve |
QuietSieve can identify and search removable drives for specific file name extensions.[37] |
S0481 | Ragnar Locker |
Ragnar Locker may attempt to connect to removable drives and mapped network drives.[38] |
S0458 | Ramsay |
Ramsay can scan for removable media which may contain documents for collection.[39][40] |
S0148 | RTM |
RTM can obtain a list of smart card readers attached to the victim.[41][42] |
S1089 | SharpDisco |
SharpDisco has dropped a plugin to monitor external drives to |
S0603 | Stuxnet | |
S1064 | SVCReady |
SVCReady can check for the number of devices plugged into an infected host.[44] |
S0098 | T9000 |
T9000 searches through connected drives for removable storage devices.[45] |
S0467 | TajMahal |
TajMahal has the ability to identify connected Apple devices.[46] |
G0139 | TeamTNT |
TeamTNT has searched for attached VGA devices using lspci.[47] |
S0647 | Turian | |
G0010 | Turla |
Turla has used |
S0452 | USBferry | |
S0136 | USBStealer |
USBStealer monitors victims for insertion of removable drives. When dropped onto a second victim, it also enumerates drives connected to the system.[50] |
S0366 | WannaCry |
WannaCry contains a thread that will attempt to scan for new attached drives every few seconds. If one is identified, it will encrypt the files on the attached device.[51] |
S0612 | WastedLocker |
WastedLocker can enumerate removable drives prior to the encryption process.[52] |
S0251 | Zebrocy |
Zebrocy enumerates information about connected storage devices.[53] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
ID | Data Source | Data Component | Detects |
---|---|---|---|
DS0017 | Command | Command Execution |
Monitor executed commands and arguments that may attempt to gather information about attached peripheral devices and components connected to a computer system. |
DS0009 | Process | OS API Execution |
Monitor for API calls that may attempt to gather information about attached peripheral devices and components connected to a computer system. |
Process Creation |
Monitor for newly executed processes that may attempt to gather information about attached peripheral devices and components connected to a computer system. |