T1200 Hardware Additions

Technique: T1200
Tactics: Initial Access
Research, 90 days: 1
KEV CVEs mapped: 0
SigmaHQ rules: 3
Elastic, Splunk: 5
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1200

MITRE description

Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091)), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused. While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.(Citation: Ossmann Star Feb 2011)(Citation: Aleks Weapons Nov 2015)(Citation: Frisk DMA August 2016)(Citation: McMillan Pwn March 2012)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-15 GuidePoint GRIT: Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew

Detection coverage

SigmaHQ community rules

USB Device Plugged (core)
Device Installation Blocked (core)
External Disk Drive Or USB Storage Device Was Recognized By The System (core)

Elastic and Splunk rules

Linux Auditd Hardware Addition Swapoff (splunk)
Linux Hardware Addition SwapOff (splunk)
Windows Process Executed From Removable Media (splunk)
Windows USBSTOR Registry Key Modification (splunk)
Windows WPDBusEnum Registry Key Modification (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.