MaxPatrol SIEM

Detects cyberincidents that undermine cyber resilience of a company

T1200: Hardware Additions

Adversaries may introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.

While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. Adversary-in-the-Middle), keystroke injection, kernel memory reading via DMA, addition of new wireless access to an existing network, and others.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

mitre_attck_defense_evasion: PT-CR-1750: Process_from_Mounted_Disk: A process was started from a mounted disk
hacking_tools: PT-CR-1857: USB_Rubber_Ducky: Possible RubberDucky USB activity

Detection

IDDS0016Data source and componentDrive: Drive CreationDescription

Monitor for newly constructed drives or other related events associated with computer hardware and other accessories (especially new or unknown) being connected to systems. Endpoint sensors may be able to detect the addition of hardware via USB, Thunderbolt, and other external device communication ports.

IDDS0015Data source and componentApplication Log: Application Log ContentDescription

Configuration management databases (CMDB) and other asset management systems may help with the detection of computer systems or network devices that should not exist on a network.

IDDS0029Data source and componentNetwork Traffic: Network Traffic FlowDescription

Monitor for network traffic originating from unknown/unexpected hardware devices. Local network traffic metadata (such as source MAC addressing) as well as usage of network management protocols such as DHCP may be helpful in identifying hardware.

Mitigation

IDM1035NameLimit Access to Resource Over NetworkDescription

Establish network access control policies, such as using device certificates and the 802.1x standard. Restrict use of DHCP to registered devices to prevent unregistered devices from communicating with trusted systems.

IDM1034NameLimit Hardware InstallationDescription

Block unknown devices and accessories by endpoint security configuration and monitoring agent.