CYBER LIBRARY
Explore the bootcamp
Evidence & investigationIntermediate

Peripheral Device Discovery

Peripheral discovery identifies attached devices that can reveal a host's role or collection opportunities.

3 min readUpdated 12 Oct 20263 connections
Markdown

What it means

Peripheral discovery identifies attached devices that can reveal a host's role or collection opportunities. Devices include storage, cameras, microphones, and other components.

An investigation example

An unfamiliar process inventories connected cameras and removable storage before further collection activity.

Evidence to examine

Review device queries, process ancestry, attached-device history, and subsequent access to identified peripherals.

A common analytical pitfall

Device enumeration is not equivalent to activating a camera or copying removable storage.

Response considerations

Preserve the discovery sequence and verify whether any identified devices were actually used for unauthorized operations.

Attached devices can describe a host's role

Information about connected storage, cameras, printers, and other peripherals can reveal how a computer is used and what collection opportunities exist. The meaning depends on the device and workflow. Discovering a camera does not prove that it was activated, and finding removable storage does not prove files were copied to it.

Inventory tools and operating-system services legitimately enumerate devices. Investigators should connect the query to its requesting process, account, and subsequent behavior. Device identifiers can be useful, but naming and reassignment may complicate interpretation. Preserve the source and observation time rather than assume the same peripheral remained attached throughout the incident.

A fictional removable-storage lead

An academy's endpoint records show an unfamiliar process checking attached devices shortly before file activity involving removable storage. Analysts compare device events, file operations, process ancestry, and approved support work. They distinguish the existence of a storage device from evidence of specific content being written to it.

Collection and reporting should remain proportionate. Peripheral information can reveal user context or sensitive operational arrangements. If the relevant logs are incomplete, state the gap instead of using the device's presence to fill in a desired narrative. A later physical inspection may show current attachment but not establish the earlier state.

Compare three claims

Create fictional events for device enumeration, device attachment, and a file write. Write the narrow claim supported by each. Then identify the evidence needed to connect the file write to a particular removable device. The exercise develops a clear progression from discovery to use without requiring unauthorized monitoring or copying information from real external drives.

Device enumeration may return logical or previously known devices as well as currently usable hardware, depending on the source. Check the API or artifact semantics before calling every listed peripheral physically present. That distinction is especially important when interpreting removable storage or virtual devices in a reconstructed host timeline.

GO TO THE SOURCE

References & further reading

Original explanations, with primary references for deeper study.

MITRE ATT&CK T1120: Peripheral Device Discovery
EXPLORE THIS IDEA’S CONNECTIONS

A small part of a bigger picture.

4 notes · 5 connections
100%
Peripheral Device Discovery · depth 1
Drag to pan · Pinch or use +/− to zoom · Click to preview · Double-click to read
Browse notes as a list (4)
FOLLOW ANOTHER THREADExplore the rest of the library
Start with a concept. Follow its connections.
Detection & responseAbuse Elevation Control MechanismElevation-control abuse bypasses or misuses mechanisms governing privileged execution.Making change happenAcceptance criteriaDefine observable conditions for a deliverable to be accepted.Security essentialsAccess controlUnderstand subjects, resources, permissions, and enforcement through a shared-drive example, including how access changes over time.Detection & responseAccess Token ManipulationAccess token manipulation changes or adopts operating-system security contexts.Risk & resilienceAccount Access RemovalAccount access removal disrupts legitimate users by changing, deleting, or restricting their identities.Evidence & investigationAccount DiscoveryAccount discovery enumerates identities available in a system or environment.Detection & responseAccount ManipulationAccount manipulation changes identity settings to preserve or expand access.Adversarial thinkingAcquire InfrastructureInfrastructure acquisition obtains domains, servers, or other resources used to support operations.Adversarial thinkingActive ScanningActive scanning probes target infrastructure to learn reachable services or weaknesses.Security essentialsAdversary in the middleAn intermediary may observe or alter a communication path.Security essentialsAESA symmetric block cipher whose safe use depends on its mode and implementation.Making change happenAgile deliveryUse short feedback cycles to adapt toward a useful outcome.
ESC to close Searches titles and note content