H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Peripheral Device Discovery

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.

59 recorded

Relationships

mapped-to
from Peripheral Footprinting
Technique
uses
from AcidPour
Malware
uses
from ADVSTORESHELL
Malware
uses
from APT28
Group
uses
from APT37
Group
uses
from Attor
Malware
uses
from BackdoorDiplomacy
Group
uses
from BADNEWS
Malware
uses
from Bandook
Malware
uses
from BlackEnergy
Malware
uses
from Cadelspy
Malware
uses
from CHIMNEYSWEEP
Malware
uses
from Crimson
Malware
uses
from Crutch
Malware
uses
from DarkWatchman
Malware
uses
from DustySky
Malware
uses
from DynoWiper
Malware
uses
from Equation
Group
uses
from Ferocious
Malware
uses
from FlawedAmmyy
Malware
uses
from FunnyDream
Malware
uses
from Gamaredon Group
Group
uses
from Heyoka Backdoor
Malware
uses
from HIUPAN
Malware
uses
from INC Ransomware
Malware
uses
from jRAT
Malware
uses
from LockBit 2.0
Malware
uses
from LockBit 3.0
Malware
uses
from Machete
Malware
uses
from Mongall
Malware
uses
from MoonWind
Malware
uses
from NightClub
Malware
uses
from njRAT
Malware
uses
from ObliqueRAT
Malware
uses
from OilRig
Group
uses
from Operation CuckooBees
Campaign
uses
from Operation Wocao
Campaign
uses
from PlugX
Malware
uses
from Prikormka
Malware
uses
from QakBot
Malware
uses
from QuietSieve
Malware
uses
from Ragnar Locker
Malware
uses
from Ramsay
Malware
uses
from ROADSWEEP
Malware
uses
from RTM
Malware
uses
from SharpDisco
Malware
uses
from Stuxnet
Malware
uses
from SVCReady
Malware
uses
from T9000
Malware
uses
from TajMahal
Malware
uses
from TeamTNT
Group
uses
from Turian
Malware
uses
from Turla
Group
uses
from USBferry
Malware
uses
from USBStealer
Malware
uses
from Volt Typhoon
Group
uses
from WannaCry
Malware
uses
from WastedLocker
Malware
uses
from Zebrocy
Malware
3 external

References

mitre-attack
T1120
open
Peripheral Discovery Linux
https://linuxhint.com/list-usb-devices-linux/
open
Peripheral Discovery macOS
https://ss64.com/osx/system_profiler.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance