T1120 Peripheral Device Discovery

Technique: T1120
Tactics: Discovery
Research, 90 days: 2
KEV CVEs mapped: 0
SigmaHQ rules: 2
Elastic, Splunk: 2
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1120

MITRE description

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
2026-09-17 ESET: Beware the SparroWock: The backdoor that bites, the commands that catch

Detection coverage

SigmaHQ community rules

Powershell Suspicious Win32_PnPEntity (core)
Fsutil Drive Enumeration (core)

Elastic and Splunk rules

PowerShell Suspicious Script with Audio Capture Capabilities (elastic)
Peripheral Device Discovery (elastic)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.