T1200: Hardware Additions
Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.
While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. Adversary-in-the-Middle), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.[1][2][3][4]
Analyst context for executives and security teams
Hardware Additions is an initial access technique where an adversary physically introduces a device or accessory into an environment to create a new path into systems or networks. For leaders, the key issue is not just “USB risk”; it is whether physical access, endpoint hardware policy, and network access controls are coordinated well enough to stop or quickly identify an unapproved device that changes the trust boundary.
Executive priority
Prioritize this where physical access to offices, branches, data centers, trading floors, labs, or operational sites could translate into network access. The business question is whether facilities controls, endpoint controls, network segmentation, and incident response procedures produce auditable evidence that only approved hardware can connect or operate. This matters for resilience because a small unauthorized device can become an initial-access foothold before traditional SOC alerts have enough context.
Technical view
ATT&CK maps T1200 to Initial Access across Windows, Linux, and macOS. MITRE does not provide official detection text, so teams should validate coverage against the related detection strategy DET0069 for unauthorized or suspicious hardware additions across USB, Thunderbolt, and network-connected devices. SOC and IR teams should test whether they can identify newly attached peripherals, driver or device installation events, unexpected network interfaces, rogue network hardware, and new wireless access points. Because ATT&CK references capabilities such as passive network tapping, traffic modification, keystroke injection, DMA-style access, and added wireless access points, defenders should treat this as a combined physical, endpoint, and network visibility problem rather than an endpoint-only use case.
Likely telemetry
- Endpoint device insertion and hardware inventory records for Windows, Linux, and macOS systems
- USB, Thunderbolt, peripheral, and driver installation or usage logs where available
- Endpoint security tool events for blocked or newly observed hardware
- Network access control, switch port, DHCP, ARP, and asset discovery records for newly connected devices
- Wireless monitoring or inventory evidence for unapproved access points
Detection direction
- Validate whether DET0069-style logic is implemented for unauthorized or suspicious USB, Thunderbolt, and network hardware additions.
- Correlate new device observations with approved asset inventories, known user activity, location, and physical access records to reduce false positives from legitimate peripherals or IT maintenance.
- Tune for high-risk patterns such as previously unseen network devices, unexpected interfaces on endpoints, unapproved wireless infrastructure, or hardware appearing in sensitive locations.
- Account for blind spots: MITRE provides no official detection guidance for T1200, and hardware that passively taps traffic or operates outside managed endpoints may not generate endpoint alerts.
- Use the relationship to DarkVishnya as threat-intelligence context only; do not assume local exposure or current activity without environment-specific evidence.
Mitigation priorities
- Start with M1034: limit hardware installation through policy and technical controls such as restricting unapproved peripherals, disabling unnecessary ports where appropriate, restricting driver installation, and monitoring/blocking unapproved devices.
- Apply M1035: limit access to network resources so that a newly connected or unauthorized device cannot freely reach file shares, remote systems, or sensitive services without a legitimate business requirement.
- Maintain an approved hardware and network asset inventory that SOC, IT, and facilities teams can use during triage.
- Coordinate physical security, visitor/vendor management, endpoint control, and network access processes so hardware introduction is treated as an initial-access risk, not only a facilities issue.
- Prepare IR playbooks for suspected unauthorized hardware that include containment, evidence preservation, network review, and physical location checks.
Analyst notes and limits
Public ATT&CK references for threat actor usage are described as scarce, while red teams and penetration testers commonly use this class of technique. The supplied relationship shows DarkVishnya used this technique and identifies the group as financially motivated with historical targeting of Eastern European financial institutions in 2017-2018. That relationship is useful for scenario planning, especially in financial environments, but it should not be generalized into claims of current exploitation.
The ATT&CK object has no official detection text, no procedure details beyond the supplied group relationship, and no environment-specific indicators. Coverage depends heavily on local physical security, endpoint management, network access control, wireless monitoring, and asset inventory quality.
Hardware Additions
Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.
While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. Adversary-in-the-Middle), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.[1][2][3][4]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
G0105: DarkVishnya
DarkVishnya is a financially motivated threat actor targeting financial institutions in Eastern Europe. In 2017-2018 the group attacked at least 8 banks in this region.[1]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.7 | Current bundle | 31cfa6fe47a0… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Ossmann Star Feb 2011
Michael Ossmann. (2011, February 17). Throwing Star LAN Tap. Retrieved March 30, 2018.
Open source URL -
[2]
Aleks Weapons Nov 2015
Nick Aleks. (2015, November 7). Weapons of a Pentester - Understanding the virtual & physical tools used by white/black hat hackers. Retrieved March 30, 2018.
Open source URL -
[3]
Frisk DMA August 2016
Ulf Frisk. (2016, August 5). Direct Memory Attack the Kernel. Retrieved March 30, 2018.
Open source URL -
[4]
McMillan Pwn March 2012
Robert McMillan. (2012, March 3). The Pwn Plug is a little white box that can hack your network. Retrieved March 30, 2018.
Open source URL -
[5]
mitre-attack T1200Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.