Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1120: Peripheral Device Discovery

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.[1][2] Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.

EnterpriseT1120TechniqueObject v1.4 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Peripheral Device Discovery is a discovery behavior where an adversary inventories devices attached to a host, such as keyboards, printers, cameras, smart card readers, or removable storage. For leaders, the value is not the inventory command itself; it is what that knowledge can enable next: choosing collection paths, identifying removable media, understanding user workstation context, or preparing follow-on actions in environments where peripherals affect access, data movement, or operations.

Executive priority

Prioritize this technique where endpoint visibility, removable media governance, smart card usage, cameras, printers, or operationally sensitive workstations matter to business continuity or compliance evidence. It is especially relevant for SOC and IR readiness because ATT&CK lists many espionage campaigns, groups, and Windows malware families as using this behavior, while the technique also spans Linux, macOS, and Windows. Executives should ask whether peripheral inventory and device-access activity is logged, retained, and reviewable during an incident, not just whether USB blocking policies exist.

Technical view

Validate coverage for discovery activity on Linux, macOS, and Windows hosts. MITRE provides no official detection text for T1120, but the relationship to DET0491 indicates a detection strategy focused on peripheral device enumeration via system utilities and API calls. SOC teams should baseline legitimate administrative, help desk, asset inventory, and device-management activity, then look for unusual enumeration from unexpected users, processes, scripts, remote sessions, or malware-adjacent execution chains. Relationship context includes multiple campaigns, groups, and software entries, mostly Windows software, so Windows endpoint telemetry should be tested, but cross-platform collection should not be ignored.

Likely telemetry

  • Endpoint process creation and command-line telemetry for peripheral or hardware inventory utilities
  • Operating system device inventory and device attachment/removal events, including USB or removable storage where available
  • macOS system profiling activity and related process telemetry
  • Linux hardware or USB enumeration activity and related process telemetry
  • Windows endpoint telemetry for device enumeration through native utilities or APIs

Detection direction

  • Confirm whether DET0491 or equivalent analytics are implemented and mapped to T1120, rather than assuming ATT&CK coverage from generic discovery alerts.
  • Tune for context: peripheral enumeration by IT inventory tools may be normal, while the same behavior from a new binary, script interpreter, RAT-like process, or unusual user session may be higher value.
  • Correlate device enumeration with surrounding discovery, collection, removable media, or credential-access activity when available; standalone enumeration may be low signal.
  • Check cross-platform blind spots: Linux and macOS references are explicit, and Windows is also an ATT&CK platform for this technique.
  • Validate retention and queryability of device inventory and process telemetry before an incident; this technique may be useful as supporting evidence rather than a high-confidence alert by itself.

Mitigation priorities

  • Maintain accurate peripheral and removable media policy for sensitive workstations and environments where attached devices affect access or data handling.
  • Ensure endpoint logging captures process execution and device inventory/attachment events across Linux, macOS, and Windows systems in scope.
  • Use least privilege and device-control policies where appropriate for removable storage, smart card readers, cameras, and other sensitive peripherals.
  • Document approved administrative and asset-inventory tooling so SOC teams can distinguish expected enumeration from suspicious activity.
  • Include peripheral discovery checks in incident response triage playbooks, especially for systems handling proprietary, regulated, or operationally sensitive data.
Analyst notes and limits

ATT&CK classifies T1120 as an enterprise discovery technique and lists Linux, macOS, and Windows platforms. The supplied relationship set shows use by multiple campaigns, groups, and software families, including espionage-oriented activity and malware that may gather host context. This supports treating the behavior as an important enrichment and triage signal, not necessarily as a standalone incident declaration.

MITRE provides no official detection guidance for this object, and the supplied data does not include procedure-level details for each related actor or software entry. Local baselines, endpoint logging configuration, device-control policies, and business context are required to determine whether observed peripheral enumeration is benign administration or suspicious activity.

Official MITRE ATT&CK definition

Peripheral Device Discovery

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.[1][2] Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

Group Enterprise

G0020: Equation

Equation is a sophisticated threat group that employs multiple remote access tools. The group is known to use zero-day exploits and has developed the capability to overwrite the firmware of hard disk drives. [1]

Group Enterprise

G0067: APT37

APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.[1][2][3]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Group Enterprise

G0007: APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

Group Enterprise

G0010: Turla

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]

Group Enterprise

G0049: OilRig

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.[1][2][3][4][5][6][7]

Group Enterprise

G0139: TeamTNT

TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.[1][2][3][4][5][6][7][8][9]

Group Enterprise

G1017: Volt Typhoon

Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.[1][2][3][4]. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.[5].

Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations. [6]

Group Enterprise

G0047: Gamaredon Group

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]

In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]

Malware Enterprise

S0283: jRAT

jRAT is a cross-platform, Java-based backdoor originally available for purchase in 2012. Variants of jRAT have been distributed via a software-as-a-service platform, similar to an online subscription model.[1] [2]

LinuxWindowsmacOS
Malware Enterprise

S0385: njRAT

njRAT is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in the Middle East.[1]

Windows
Malware Enterprise

S0113: Prikormka

Prikormka is a malware family used in a campaign known as Operation Groundbait. It has predominantly been observed in Ukraine and was used as early as 2008. [1]

Windows
Malware Enterprise

S0366: WannaCry

WannaCry is ransomware that was first seen in a global attack during May 2017, which affected more than 150 countries. It contains worm-like features to spread itself across a computer network using the SMBv1 exploit EternalBlue.[1][2][3][4]

Windows
Malware Enterprise

S0251: Zebrocy

Zebrocy is a Trojan that has been used by APT28 since at least November 2015. The malware comes in several programming language variants, including C++, Delphi, AutoIt, C#, VB.NET, and Golang. [1][2][3][4]

Windows
Malware Enterprise

S0148: RTM

RTM is custom malware written in Delphi. It is used by the group of the same name (RTM). Newer versions of the malware have been reported publicly as Redaman.[1][2]

Windows
Campaign Enterprise

C0012: Operation CuckooBees

Operation CuckooBees was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of Operation CuckooBees, which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed Operation CuckooBees was conducted by actors affiliated with Winnti Group, APT41, and BARIUM.[1]

Campaign Enterprise

C0014: Operation Wocao

Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.[1]

Security researchers assessed the Operation Wocao actors used similar TTPs and tools as APT20, suggesting a possible overlap. Operation Wocao was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.[1]

Relationship explorer

All related ATT&CK context

uses · Malware S1139: INC Ransomware Enterprise uses · Group G0020: Equation Enterprise uses · Campaign C0012: Operation CuckooBees Enterprise uses · Group G0067: APT37 Enterprise uses · Malware S0283: jRAT Enterprise uses · Malware S0538: Crutch Enterprise uses · Malware S1044: FunnyDream Enterprise uses · Malware S1149: CHIMNEYSWEEP Enterprise uses · Malware S0385: njRAT Enterprise uses · Malware S1026: Mongall Enterprise uses · Malware S0113: Prikormka Enterprise uses · Malware S0366: WannaCry Enterprise uses · Malware S0251: Zebrocy Enterprise uses · Malware S0148: RTM Enterprise uses · Malware S0644: ObliqueRAT Enterprise uses · Malware S0234: Bandook Enterprise uses · Malware S1167: AcidPour Enterprise uses · Malware S0458: Ramsay Enterprise uses · Group G0007: APT28 Enterprise uses · Malware S0452: USBferry Enterprise uses · Malware S0149: MoonWind Enterprise uses · Malware S0062: DustySky Enterprise uses · Malware S0438: Attor Enterprise uses · Malware S1064: SVCReady Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.4
Created
Modified
Raw hash
f7248e5889b4e662...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.4 Current bundle f7248e5889b4…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Peripheral Discovery Linux

    Shahriar Shovon. (2018, March). List USB Devices Linux. Retrieved March 11, 2022.

    Open source URL
  2. [2]
    Peripheral Discovery macOS

    SS64. (n.d.). system_profiler. Retrieved March 11, 2022.

    Open source URL
  3. [3]
    mitre-attack T1120
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use