title: Peripheral Device Discovery (T1120)
id: df00tech-t1120
status: experimental
description: "Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions — ransomware families identify removable drives for encryption and printers for ransom note delivery, RATs enumerate cameras and Bluetooth devices for surveillance capability profiling, and APT groups map USB storage history to understand data exfiltration opportunities."
references:
  - https://attack.mitre.org/techniques/T1120/
  - https://df00tech.com/detections/T1120
author: df00tech
date: 2026/04/18
tags:
  - attack.t1120
# NOTE: logsource is auto-derived and may need adjustment for your environment
logsource:
  category: process_creation
  product: windows
detection:
  # This detection logic could not be auto-translated; see the KQL/SPL query on df00tech.
  selection:
    EventID: '*'
  condition: selection
falsepositives:
  - "IT asset management and hardware inventory tools (SCCM hardware inventory running under CcmExec.exe, Tanium, Lansweeper, Spiceworks) that periodically query WMI for device configuration"
  - "Disk health and monitoring software (CrystalDiskInfo, SMART monitoring agents, backup software like Veeam or Acronis) that enumerate drives at startup or on schedule"
  - "Help desk and remote support tools (TeamViewer, ConnectWise, Dameware) that collect hardware information automatically when a session starts"
  - Data Loss Prevention (DLP) agents that legitimately monitor USB connections will themselves query USBSTOR registry paths and WMI USB classes — identify DLP agent executables and exclude them
  - Legitimate system administration scripts using Get-PnpDevice or wmic for driver troubleshooting and device inventory audits
level: medium