T1120

Peripheral Device Discovery

Discovery Last updated:

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions — ransomware families identify removable drives for encryption and printers for ransom note delivery, RATs enumerate cameras and Bluetooth devices for surveillance capability profiling, and APT groups map USB storage history to understand data exfiltration opportunities.

What is T1120 Peripheral Device Discovery?

Peripheral Device Discovery (T1120) maps to the Discovery tactic — the adversary is trying to figure out your environment in MITRE ATT&CK.

This page provides production-ready detection logic for Peripheral Device Discovery, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Windows Registry: Windows Registry Key Access, Microsoft Defender for Endpoint. The queries below are rated medium severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Discovery
Technique
T1120 Peripheral Device Discovery
Canonical reference
https://attack.mitre.org/techniques/T1120/
Microsoft Sentinel / Defender
kusto 
let PeripheralWMIClasses = dynamic([
  "Win32_USBHub", "Win32_USBController", "Win32_DiskDrive",
  "Win32_PhysicalMedia", "Win32_CDROMDrive",
  "Win32_PrinterConfiguration", "Win32_Printer",
  "Win32_PnPEntity", "Win32_SoundDevice"
]);
let RegistryUSBPaths = dynamic(["USBSTOR", "Enum\\USB"]);
let ProcessDiscovery = DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    (FileName =~ "wmic.exe" and ProcessCommandLine has_any ("logicaldisk", "diskdrive", "USBHub", "USBController", "PhysicalMedia", "CDROMDrive", "printer", "Win32_USB", "PnPEntity"))
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any (PeripheralWMIClasses))
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-PnpDevice", "[System.IO.DriveInfo]::GetDrives", "Get-Volume", "Get-Disk"))
    or (FileName =~ "fsutil.exe" and ProcessCommandLine has "fsinfo drives")
    or (FileName =~ "reg.exe" and ProcessCommandLine has_any (RegistryUSBPaths))
)
| extend EnumerationType = case(
    ProcessCommandLine has_any ("USBHub", "USBSTOR", "USBController", "Win32_DiskDrive"), "USB_Device",
    ProcessCommandLine has_any ("printer", "Win32_Printer", "PrinterConfiguration"), "Printer",
    ProcessCommandLine has_any ("logicaldisk", "LogicalDisk", "fsinfo drives", "DriveInfo", "Get-Volume", "Get-Disk", "PhysicalMedia"), "Drive_Enumeration",
    ProcessCommandLine has_any ("PnpDevice", "PnPEntity", "CDROMDrive", "SoundDevice"), "PnP_Device",
    ProcessCommandLine has_any (RegistryUSBPaths), "USB_Registry_Enum",
    "General_Peripheral"
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, EnumerationType;
let RegistryDiscovery = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has_any (RegistryUSBPaths)
| where ActionType in ("RegistryKeyQueried", "RegistryValueQueried")
| where InitiatingProcessFileName !in~ ("svchost.exe", "services.exe", "System", "MsMpEng.exe", "TrustedInstaller.exe", "WmiPrvSE.exe")
| extend EnumerationType = "USB_Registry_Enum"
| project Timestamp, DeviceName,
         AccountName=InitiatingProcessAccountName,
         FileName=InitiatingProcessFileName,
         ProcessCommandLine=InitiatingProcessCommandLine,
         InitiatingProcessFileName=InitiatingProcessParentFileName,
         InitiatingProcessCommandLine=InitiatingProcessParentCommandLine,
         EnumerationType;
union ProcessDiscovery, RegistryDiscovery
| sort by Timestamp desc

Detects peripheral device discovery across two event sources. DeviceProcessEvents catches process-level peripheral enumeration: WMIC queries against USB, disk drive, printer, and PnP WMI classes; PowerShell cmdlets Get-PnpDevice, Get-Volume, Get-Disk, and WMI queries; fsutil drive listing; and reg.exe reading USB registry paths. DeviceRegistryEvents catches stealthier registry-based USB device history reads from USBSTOR and USB enumeration paths by non-system processes. Results are classified by enumeration type to help analysts prioritize alerts — USB_Device and USB_Registry_Enum are highest priority, particularly when followed by file write activity.

medium severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Windows Registry: Windows Registry Key Access Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents DeviceRegistryEvents

False Positives

  • IT asset management and hardware inventory tools (SCCM hardware inventory running under CcmExec.exe, Tanium, Lansweeper, Spiceworks) that periodically query WMI for device configuration
  • Disk health and monitoring software (CrystalDiskInfo, SMART monitoring agents, backup software like Veeam or Acronis) that enumerate drives at startup or on schedule
  • Help desk and remote support tools (TeamViewer, ConnectWise, Dameware) that collect hardware information automatically when a session starts
  • Data Loss Prevention (DLP) agents that legitimately monitor USB connections will themselves query USBSTOR registry paths and WMI USB classes — identify DLP agent executables and exclude them
  • Legitimate system administration scripts using Get-PnpDevice or wmic for driver troubleshooting and device inventory audits

Sigma rule & cross-platform mapping

The detection logic for Peripheral Device Discovery (T1120) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1120 Sigma rules on detection.fyi

Platform-specific guides for T1120

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-18 Research depth: deep
References (10)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1USB Hub and Disk Enumeration via WMIC

    Expected signal: Sysmon Event ID 1: Two Process Create events with Image=wmic.exe. First CommandLine contains 'Win32_USBHub' and 'DeviceID,Name,Description'. Second CommandLine contains 'Win32_DiskDrive' and 'MediaType' and 'Removable Media'. Security Event ID 4688 (if command line auditing enabled) for both executions. Microsoft-Windows-WMI-Activity/Operational shows the WMI namespace queries.

  2. Test 2Removable Drive Discovery via PowerShell WMI and PnP

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Win32_LogicalDisk', 'DriveType', 'eq 2', and 'Get-PnpDevice'. PowerShell ScriptBlock Log Event ID 4104 with full deobfuscated script content showing the WMI query with DriveType filter. Console output lists all removable drives with DeviceID and volume names.

  3. Test 3Printer Enumeration via WMIC for Ransom Note Targeting

    Expected signal: Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'printer' and 'PortName,DriverName'. Security Event ID 4688 with full command line. Microsoft-Windows-WMI-Activity/Operational Event ID 5857 showing the Win32_Printer provider loaded. Output lists all configured printers with network vs local status.

  4. Test 4Drive Letter Enumeration via fsutil LOLBin

    Expected signal: Sysmon Event ID 1: Process Create with Image=fsutil.exe, CommandLine='fsutil fsinfo drives'. Security Event ID 4688 if command line auditing is enabled. Output format: 'Drives: C:\ D:\ E:\' — presence of multiple drives beyond C:\ indicates attached removable or additional storage.

  5. Test 5USB Device History Extraction from Registry

    Expected signal: Sysmon Event ID 1: Process Create for reg.exe with CommandLine containing 'USBSTOR'. Sysmon Event ID 12 or 13: RegistryEvent for HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR registry key queries (if registry monitoring is configured for this path). Security Event ID 4663 if object access auditing is enabled on the USBSTOR registry key. Output contains all USB device classes with vendor IDs, product IDs, and serial numbers.

Response Playbook

Triage

  1. Identify the process performing the enumeration — was it wmic.exe, powershell.exe, reg.exe, or a custom binary? Check if the parent process is a known management tool (CcmExec.exe for SCCM, TaniumClient.exe, NessusAgent.exe) before escalating; if the parent is cmd.exe, wscript.exe, or mshta.exe, treat as high priority
  2. Examine the full command line to determine exactly what peripheral class was queried — targeted USB-specific enumeration (Win32_USBHub, USBSTOR) is more suspicious than generic disk listing; printer enumeration combined with ransomware indicators warrants immediate escalation
  3. Check the account context — is this a service account associated with IT management software, or an interactive user session? Service accounts from known management tools are low risk; user accounts querying USB devices on servers or user accounts that wouldn't normally run WMIC are high risk
  4. Correlate with other discovery activity on the same host within the same 30-minute window — peripheral discovery is frequently chained with T1082 (System Information Discovery), T1083 (File Discovery), and T1135 (Network Share Discovery) in systematic post-compromise reconnaissance; multiple discovery techniques together indicate a higher-confidence compromise
  5. Check whether any removable drives were actually connected around the time of enumeration — query Sysmon Event ID 12/13 for HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR registry activity, or Windows Event IDs in Microsoft-Windows-DriverFrameworks-UserMode/Operational for USB connection events; enumeration timing close to a physical device insertion is particularly suspicious
  6. For WMI-based queries, determine if the WMI query ran locally or was invoked via WMI remote execution — check for Sysmon Event ID 3 (Network Connection) from WmiPrvSE.exe and look for Windows Event ID 4648 (explicit credential logon) preceding the query, which would indicate remote WMI lateral movement alongside peripheral discovery

Containment

  1. If peripheral discovery appears to be part of active ransomware pre-encryption reconnaissance (INC Ransomware, WannaCry pattern): immediately isolate the endpoint from the network using EDR network isolation to prevent file encryption from spreading to attached removable drives and network shares
  2. If a RAT performing peripheral profiling is suspected (njRAT, Bandook, ObliqueRAT pattern based on process hierarchy and parent-child relationships): kill the malicious process, quarantine the binary from its on-disk location, and isolate the endpoint before the attacker can act on the discovered device inventory
  3. If lateral movement is suspected alongside peripheral discovery (remote WMI from a pivot point): isolate the source host performing the remote WMI query, not just the target; check for WMI subscriptions that may provide persistence
  4. Disable AutoRun and AutoPlay on all endpoints via Group Policy (Computer Configuration > Administrative Templates > Windows Components > AutoPlay Policies > Turn off AutoPlay: All drives) if not already enforced — this prevents removable media-based malware propagation if attacker accesses enumerated drives
  5. If attacker appears to be targeting removable media for data staging or exfiltration: notify the data owner, preserve any removable drives currently connected as potential evidence, and monitor for file creation events on removable drive letters (D:\, E:\, F:\) before physical collection

Evidence Collection

  1. Process creation events — Sysmon Event ID 1 for the enumeration commands with full command line; Security Event ID 4688 (requires Command Line Auditing enabled via GPO) as a backup source
  2. Registry access events — Sysmon Event ID 12 (RegistryEvent Object Create/Delete) and Event ID 13 (RegistryEvent Value Set) for queries to HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR, which contains the full historical record of all USB storage devices ever connected, including vendor ID, product ID, serial numbers, and timestamps
  3. WMI activity events — Microsoft-Windows-WMI-Activity/Operational (Event ID 5857 for provider load, 5858 for error, 5861 for consumer creation) to capture the full WMI namespace and query strings used for peripheral enumeration
  4. Device plug/unplug history — Microsoft-Windows-DriverFrameworks-UserMode/Operational (Event IDs 2003, 2004, 2100, 2101) for USB device connection and disconnection events with timestamps; Microsoft-Windows-Kernel-PnP/Device Configuration for device installation history
  5. USB device connection registry artifacts — HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR (device class GUID, vendor ID, product ID, device serial number, last connected timestamp), HKLM\SYSTEM\CurrentControlSet\Enum\USB, and HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 (drive letters assigned per user)
  6. PowerShell ScriptBlock Logging (Event ID 4104) if PowerShell was used — captures the full script content including WMI class names, filter conditions (e.g., DriveType=2 for removable), and any code that processes the enumeration results
  7. Network connections from the enumerating process (Sysmon Event ID 3) to identify if results were transmitted to a C2 server; also check for Sysmon Event ID 11 (File Created) for any output files written containing the device inventory
  8. Memory image of the enumerating process if still running — may contain decoded payloads, C2 server addresses, and the full device inventory collected

Escalation Criteria

  • ! Peripheral discovery immediately followed (within 60 minutes) by file write or copy operations to removable drive letters (D:\, E:\, F:\) — indicates data staging for physical exfiltration or malware propagation to USB drives
  • ! Discovery performed by a process running from a suspicious location (temp directory, %AppData%, user Downloads) or a recently written binary not in the software inventory — indicates a malicious tool rather than a legitimate management agent
  • ! Multiple peripheral discovery techniques executed in rapid succession (USB + printer + camera + Bluetooth enumeration within 5 minutes) from the same process — consistent with RAT capability initialization that builds a device profile for remote operators
  • ! Peripheral discovery combined with other discovery techniques (T1082 system info, T1016 network config, T1033 user info, T1135 network shares) within a 30-minute window — systematic reconnaissance strongly indicates active post-compromise activity
  • ! Printer enumeration on a host that subsequently shows new document creation or print spooler activity — ransomware families print ransom notes immediately after identifying available printers
  • ! USB enumeration from a newly created service or scheduled task not present in the environment baseline — persistence-plus-discovery combination indicates an established implant beginning to profile the environment

Investigation Guide

Forensic Artifacts

  • > Registry: HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR — the most valuable forensic artifact for USB peripheral discovery; contains historical record of every USB storage device ever connected, organized by device class GUID, vendor ID, product ID, and serial number, with subkeys containing friendly name, hardware ID, and last known configuration
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Enum\USB — all USB devices (not just storage), including hubs, cameras, keyboards, Bluetooth adapters, and dongles — queried by RATs performing comprehensive peripheral profiling
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Enum\SCSI — SCSI and SATA disk drives; queried by Equation Group tools investigating hard drive firmware for potential overwrite attacks
  • > Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 — per-user record of drive letter assignments for removable media; reveals which drives a specific user interacted with via Explorer
  • > Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders — shell folder paths that may reveal user-accessible removable drive contents
  • > Windows Event Log: Microsoft-Windows-DriverFrameworks-UserMode/Operational (Event IDs 2003 for device initialized, 2100 for device removed) — physical USB device connection/disconnection history with precise timestamps
  • > Windows Event Log: Microsoft-Windows-Kernel-PnP/Device Configuration — device installation events with vendor/product IDs, correlate with USBSTOR registry entries
  • > Windows Event Log: Microsoft-Windows-WMI-Activity/Operational — WMI query audit trail; Event ID 5857 shows when WMI providers (including Win32_DiskDrive provider) are loaded, correlated with peripheral enumeration timing
  • > File System: C:\Windows\Prefetch\WMIC.EXE-*.pf — execution timestamps and loaded DLLs confirming wmic.exe ran on the system, even if process logs were cleared
  • > WMI Repository: C:\Windows\System32\wbem\Repository — may contain evidence of persistent WMI subscriptions used for ongoing device monitoring (malware creating subscriptions to detect removable drive insertion)

Tuning Guidance

The primary false positive source is IT asset management infrastructure. Build an allowlist of known inventory agent parent processes and exclude their WMI queries: CcmExec.exe (SCCM), TaniumClient.exe (Tanium), NessusAgent.exe (Tenable), ZabbixAgent.exe, CollectdPlugin.exe, and any other endpoint agents in your environment. For DLP tools, identify the DLP agent executable (varies by vendor — Symantec DLP, Forcepoint, Microsoft Purview) and exclude it from USBSTOR registry alerts, since DLP agents legitimately and continuously monitor these paths. For Get-PnpDevice and Get-Volume, these are common in legitimate PowerShell administration and will be noisy on endpoints with active administrators — consider requiring that the parent process be an unexpected shell (wscript.exe, mshta.exe, cmd.exe not from conhost, or Office applications) before alerting. The highest-fidelity signal is the discovery-then-write correlation hunting query: require peripheral discovery followed by file writes to removable drive letters within one hour — this dramatically reduces false positives while catching the most dangerous attack chains (ransomware, data staging, malware propagation). For environments with authorized removable media policies, use MountPoints2 registry data to baseline expected drive usage per user and alert only on users writing to drive letters not in their normal profile. Enable Windows Plug and Play Device Installation audit policy (via auditpol or GPO) to get Event ID 6416 (new device detected) and correlate physical device insertions with discovery activity timing.

Hunting Queries

Hunt for non-system processes that programmatically read the USBSTOR or USB registry hives, which contain historical records of all USB devices ever connected to the system. Malware, RATs, and reconnaissance tools read these registry paths to enumerate USB device history without generating WMI telemetry. Multiple accesses from a single non-system process — especially from unexpected processes like cmd.exe children, script interpreters, or unknown binaries — are a strong indicator of automated USB device profiling distinct from the main detection pattern which focuses on process command lines.

Hunting — KQL
kql 
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has_any ("USBSTOR", "Enum\\USB")
| where ActionType in ("RegistryKeyQueried", "RegistryValueQueried")
| where InitiatingProcessFileName !in~ (
    "svchost.exe", "services.exe", "System",
    "MsMpEng.exe", "TrustedInstaller.exe",
    "WmiPrvSE.exe", "SearchIndexer.exe", "explorer.exe"
)
| summarize
    AccessCount=count(),
    ActionTypes=make_set(ActionType),
    SampledKeys=make_set(RegistryKey, 5)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| where AccessCount > 2
| sort by AccessCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=12 OR EventCode=13 OR EventCode=14) (TargetObject="*USBSTOR*" OR TargetObject="*Enum\\USB*")
  NOT (Image="*\\svchost.exe" OR Image="*\\services.exe" OR Image="*\\MsMpEng.exe" OR Image="*\\TrustedInstaller.exe" OR Image="*\\WmiPrvSE.exe" OR Image="*\\explorer.exe")
| stats count as RegAccessCount, values(TargetObject) as RegistryKeys, dc(TargetObject) as UniqueKeys by host, Image, CommandLine, User
| where RegAccessCount > 2
| sort - RegAccessCount

Hunt for rapid successive peripheral discovery commands within a 10-minute window. Malware like WannaCry scans for new drives every few seconds, Crutch monitors for removable drive insertion in a loop, and RAT initialization routines query multiple WMI classes in sequence to build a complete device profile. Two or more distinct peripheral WMI queries from the same user or parent process in a short window indicates automated, programmatic discovery rather than manual administrative investigation.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("wmic.exe", "powershell.exe", "pwsh.exe", "fsutil.exe", "reg.exe")
| where ProcessCommandLine has_any (
    "Win32_USBHub", "Win32_DiskDrive", "Win32_LogicalDisk",
    "Get-PnpDevice", "Win32_Printer", "Win32_CDROMDrive",
    "USBSTOR", "fsinfo drives", "Win32_PnPEntity", "Win32_PhysicalMedia"
)
| summarize
    CommandCount=count(),
    UniqueCommands=dcount(ProcessCommandLine),
    Commands=make_set(ProcessCommandLine, 10),
    Classes=make_set(FileName)
  by DeviceName, AccountName, InitiatingProcessFileName, bin(Timestamp, 10m)
| where CommandCount > 2 or UniqueCommands > 1
| sort by CommandCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  ((Image="*\\wmic.exe" AND (CommandLine="*Win32_USBHub*" OR CommandLine="*Win32_DiskDrive*" OR CommandLine="*Win32_LogicalDisk*" OR CommandLine="*Win32_Printer*" OR CommandLine="*CDROMDrive*" OR CommandLine="*PnPEntity*"))
  OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*Get-PnpDevice*" OR CommandLine="*Win32_DiskDrive*" OR CommandLine="*Win32_USBHub*" OR CommandLine="*Get-Volume*" OR CommandLine="*Get-Disk*"))
  OR (Image="*\\fsutil.exe" AND CommandLine="*fsinfo drives*")
  OR (Image="*\\reg.exe" AND CommandLine="*USBSTOR*"))
| bin _time span=10m
| stats count as CmdCount, dc(CommandLine) as UniqueCmds, values(CommandLine) as Commands, values(Image) as Tools by host, User, ParentImage, _time
| where CmdCount > 2 OR UniqueCmds > 1
| sort - CmdCount

Hunt for the critical attack chain: peripheral device discovery followed by file writes to removable drive letters within one hour. This correlation identifies ransomware encrypting USB drives (WannaCry, INC Ransomware), data theft scenarios where sensitive files are staged to removable media after enumeration, and malware propagation where malicious files are copied to USB drives for lateral movement or air-gap bridging. Removable drives are heuristically identified by drive letters D through H, which are most commonly assigned to removable or external storage in Windows environments. This hunting query finds different attack chains than the main detection — the main rule triggers on the discovery act itself, while this query triggers on the discovery-then-act sequence.

Hunting — KQL
kql 
let PeripheralDiscovery = DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any (
    "Win32_USBHub", "Win32_DiskDrive", "Win32_LogicalDisk",
    "Get-PnpDevice", "USBSTOR", "Win32_Printer",
    "fsinfo drives", "Win32_LogicalDisk", "Get-Volume"
)
| project DeviceName, AccountName, DiscoveryTime=Timestamp,
         DiscoveryProcess=FileName, DiscoveryCommand=ProcessCommandLine;
let RemovableDriveWrites = DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath matches regex @"^[D-H]:\\"
| where ActionType in ("FileCreated", "FileModified")
| project DeviceName, AccountName, WriteTime=Timestamp,
         WrittenFile=FileName, WritePath=FolderPath, WritingProcess=InitiatingProcessFileName;
PeripheralDiscovery
| join kind=inner RemovableDriveWrites on DeviceName, AccountName
| where WriteTime between (DiscoveryTime .. (DiscoveryTime + 1h))
| project DeviceName, AccountName, DiscoveryTime, DiscoveryCommand,
         WriteTime, WrittenFile, WritePath, WritingProcess
| sort by DiscoveryTime desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
[
  search EventCode=1 (CommandLine="*Win32_DiskDrive*" OR CommandLine="*Win32_USBHub*" OR CommandLine="*Get-PnpDevice*" OR CommandLine="*USBSTOR*" OR CommandLine="*fsinfo drives*" OR CommandLine="*Get-Volume*")
  | eval earliest_discovery=_time, latest_window=_time+3600
  | table host, User, earliest_discovery, latest_window
]
| join type=inner host [
  search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
    (TargetFilename="D:\\*" OR TargetFilename="E:\\*" OR TargetFilename="F:\\*" OR TargetFilename="G:\\*" OR TargetFilename="H:\\*")
  | eval file_write_time=_time
  | table host, User, TargetFilename, Image, file_write_time
]
| where file_write_time >= earliest_discovery AND file_write_time <= latest_window
| table host, User, earliest_discovery, file_write_time, TargetFilename, Image
| sort - earliest_discovery

Atomic Red Team Tests

Test 1 USB Hub and Disk Enumeration via WMIC
windows

Enumerates USB hubs and removable disk drives connected to the system using WMIC queries against Win32_USBHub and Win32_DiskDrive WMI classes. This simulates how malware like njRAT, Bandook, INC Ransomware, and Zebrocy query USB devices to identify removable storage targets for encryption or data theft. Retrieves device IDs, model names, and sizes of all USB-connected storage devices.

Command

powershell 
wmic path Win32_USBHub get DeviceID,Name,Description /format:list && wmic path Win32_DiskDrive where "MediaType='Removable Media'" get DeviceID,Model,Size,InterfaceType /format:list

Expected Telemetry

Sysmon Event ID 1: Two Process Create events with Image=wmic.exe. First CommandLine contains 'Win32_USBHub' and 'DeviceID,Name,Description'. Second CommandLine contains 'Win32_DiskDrive' and 'MediaType' and 'Removable Media'. Security Event ID 4688 (if command line auditing enabled) for both executions. Microsoft-Windows-WMI-Activity/Operational shows the WMI namespace queries.

Expected Detection

Alert fires on 'Win32_USBHub' and 'Win32_DiskDrive' pattern matches in wmic.exe CommandLine. KQL: EnumerationType='USB_Device'. SPL: USBEnum=1, SuspicionScore>=1. Both wmic invocations independently trigger the detection.

Test 2 Removable Drive Discovery via PowerShell WMI and PnP
windows

Uses PowerShell to enumerate attached removable drives and PnP disk devices via WMI, mimicking the device profiling behavior of RATs and ransomware families that use PowerShell-based WMI to discover removable storage. DriveType=2 specifically filters for removable drives (USB flash drives, memory cards). Get-PnpDevice retrieves all connected disk drives through the PnP subsystem, matching techniques seen in Crutch, FunnyDream, and ObliqueRAT.

Command

powershell 
powershell.exe -NoProfile -Command "Get-WmiObject Win32_LogicalDisk | Where-Object {$_.DriveType -eq 2} | Select-Object DeviceID,VolumeName,Size,DriveType | Format-List; Get-PnpDevice -Class DiskDrive | Select-Object Name,DeviceID,Status,InstanceId | Format-List"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Win32_LogicalDisk', 'DriveType', 'eq 2', and 'Get-PnpDevice'. PowerShell ScriptBlock Log Event ID 4104 with full deobfuscated script content showing the WMI query with DriveType filter. Console output lists all removable drives with DeviceID and volume names.

Expected Detection

Alert fires on 'Win32_LogicalDisk' and 'Get-PnpDevice' pattern matches in powershell.exe CommandLine. KQL: DriveEnum=1 and PnPEnum=1. SPL: DriveEnum=1, PnPEnum=1, SuspicionScore=2.

Test 3 Printer Enumeration via WMIC for Ransom Note Targeting
windows

Enumerates all printers connected to or accessible from the system using WMIC queries against the Win32_Printer WMI class. This mimics the technique used by INC Ransomware and Prikormka malware to identify available printers before printing ransom notes. The command retrieves printer names, port names, driver names, and status — exactly the information ransomware needs to identify active print targets.

Command

powershell 
wmic printer get Name,PortName,DriverName,PrinterStatus,ServerName,Local,Network /format:list

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'printer' and 'PortName,DriverName'. Security Event ID 4688 with full command line. Microsoft-Windows-WMI-Activity/Operational Event ID 5857 showing the Win32_Printer provider loaded. Output lists all configured printers with network vs local status.

Expected Detection

Alert fires on 'printer' pattern match in wmic.exe CommandLine. KQL: EnumerationType='Printer'. SPL: PrinterEnum=1, EnumerationType='Printer', SuspicionScore=1.

Test 4 Drive Letter Enumeration via fsutil LOLBin
windows

Uses the built-in Windows fsutil utility to list all drive letters currently assigned on the system, including removable drives. fsutil.exe is a Microsoft-signed LOLBin that generates less suspicion than wmic.exe or PowerShell for basic drive enumeration. Threat actors use it to quickly identify attached drives including USB storage without requiring WMI access. The output lists all active drive letters — removable drives appear as additional entries beyond the system C: drive.

Command

powershell 
fsutil fsinfo drives

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=fsutil.exe, CommandLine='fsutil fsinfo drives'. Security Event ID 4688 if command line auditing is enabled. Output format: 'Drives: C:\ D:\ E:\' — presence of multiple drives beyond C:\ indicates attached removable or additional storage.

Expected Detection

Alert fires on 'fsinfo drives' pattern match for fsutil.exe. KQL: DriveEnum=1, EnumerationType='Drive_Enumeration'. SPL: DriveEnum=1, SuspicionScore=1.

Test 5 USB Device History Extraction from Registry
windows

Reads the USBSTOR and USB registry hives to enumerate all USB devices that have ever been connected to this system, including historical records not visible through WMI queries. This technique is used by sophisticated threat actors (Equation Group as documented by Kaspersky) and forensic tools to discover the complete USB device history of a target. The USBSTOR key reveals vendor/product IDs, device serial numbers, and can indicate high-value targets (encrypted drives, data transfer devices). This approach avoids WMI telemetry entirely.

Command

powershell 
reg query HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR /s && reg query HKLM\SYSTEM\CurrentControlSet\Enum\USB /s /f "VID_"

Expected Telemetry

Sysmon Event ID 1: Process Create for reg.exe with CommandLine containing 'USBSTOR'. Sysmon Event ID 12 or 13: RegistryEvent for HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR registry key queries (if registry monitoring is configured for this path). Security Event ID 4663 if object access auditing is enabled on the USBSTOR registry key. Output contains all USB device classes with vendor IDs, product IDs, and serial numbers.

Expected Detection

Alert fires on DeviceRegistryEvents with RegistryKey containing 'USBSTOR' from reg.exe. KQL: EnumerationType='USB_Registry_Enum'. SPL: RegistryEnum=1 in process events, or EventCode=12/13 with TargetObject matching 'USBSTOR' in registry events.

Related Detections

Tactic Hub

TA0007Discovery

Related Techniques

T1082System Information DiscoveryT1083File and Directory DiscoveryT1074.001Local Data StagingT1052.001Exfiltration over USBT1025Data from Removable MediaT1091Replication Through Removable MediaT1135Network Share DiscoveryT1033System Owner/User DiscoveryT1047Windows Management Instrumentation

Same Tactic: Discovery

Popular Detections