1. Home
  2. Techniques
  3. Enterprise
  4. 外围设备发现

外围设备发现

ID Name
T1120.001 合法系统工具滥用扫描
T1120.002 设备指纹模糊化探测
T1120.003 加密通道外联设备发现

外围设备发现是攻击者通过枚举计算机连接的物理设备（如USB存储、智能卡读卡器、打印机等）来获取系统环境信息的技术手段，通常用于识别潜在数据泄露渠道或特权设备。攻击者可能调用系统API、检查设备管理器条目或解析即插即用事件日志来收集设备信息，为后续横向移动或数据窃取提供情报支撑。防御措施包括监控设备管理API调用、分析进程树中的异常命令行参数，以及检测非常规外设连接事件。

为规避传统设备发现技术因API调用特征明显、网络外传行为集中而暴露的风险，攻击者发展出多维度的隐蔽实施方法，通过工具链滥用、间接信息推断和加密通信融合等策略，将设备发现行为深度嵌入系统正常运维活动中，形成"低特征、高融合"的新型设备侦察范式。

现有外围设备发现匿迹技术的核心逻辑聚焦于操作痕迹消除与数据流隐匿。攻击者通过系统信任机制渗透，将恶意设备查询指令封装在合法管理工具执行流中，消除异常进程创建痕迹；利用日志审计盲区，从非传统数据源间接推导设备信息，避免触发API监控告警；在网络传输层构建加密隧道，将设备元数据伪装成业务通信内容。三类技术的共性在于突破传统设备发现技术的显性特征，通过系统功能寄生、数据源迁移和协议层隐匿三重机制，实现设备侦察行为的"去武器化"伪装。特别是加密通道技术的应用，使得设备信息外传突破网络层检测屏障，形成端到端的隐蔽数据泄露管道。

匿迹技术的演进导致传统基于API调用监控和明文流量分析的防御手段面临失效风险，防御方需加强系统管理工具的行为基线建模，实施细粒度的日志审计策略，并部署加密流量威胁检测系统，通过上下文关联分析识别异常设备信息传输行为。

ID: T1120
Sub-techniques:  T1120.001, T1120.002, T1120.003
ⓘ
Tactic: 环境测绘
ⓘ
Platforms: Linux, Windows, macOS
ⓘ
Permissions Required: Administrator, SYSTEM, User
Version: 1.3
Created: 31 May 2017
Last Modified: 30 March 2023

匿迹效应

效应类型 是否存在
特征伪装 ✅
行为透明 ❌
数据遮蔽 ✅
时空释痕 ✅

特征伪装

攻击者通过滥用系统内置管理工具（如PowerShell、WMI）执行设备发现操作，使恶意行为在进程名称、命令行参数等维度与合法管理任务完全一致。同时将网络外传流量封装在HTTPS等加密协议中，伪装成正常业务通信，破坏基于协议特征识别的检测机制。

数据遮蔽

在设备信息外传阶段采用TLS加密传输，隐藏设备元数据的明文特征。加密通道不仅保护通信内容不被中间节点解析，还通过证书伪装使恶意流量呈现合法服务交互特征，规避基于载荷特征匹配的检测规则。

时空释痕

通过低频次、长周期的设备查询策略，将集中式扫描任务分散到数月时间跨度执行。结合用户实际外设使用习惯动态调整探测节奏，使设备发现事件在时间序列上呈现自然分布特征，破坏基于操作频次异常的检测模型。

Procedure Examples

ID Name Description
S0045 ADVSTORESHELL

ADVSTORESHELL can list connected devices.[1]
G0007 APT28

APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim.[2]
G0067 APT37

APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices. [3]
S0438 Attor

Attor has a plugin that collects information about inserted storage devices, modems, and phone devices.[4]
G0135 BackdoorDiplomacy

BackdoorDiplomacy has used an executable to detect removable media, such as USB flash drives.[5]
S0128 BADNEWS

BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.[6][7]
S0234 Bandook

Bandook can detect USB devices.[8]
S0089 BlackEnergy

BlackEnergy can gather very specific information about attached USB devices, to include device instance ID and drive geometry.[9]
S0454 Cadelspy

Cadelspy has the ability to steal information about printers and the documents sent to printers.[10]
S1149 CHIMNEYSWEEP

CHIMNEYSWEEP can monitor for removable drives.[11]
S0115 Crimson

Crimson has the ability to discover pluggable/removable drives to extract files from.[12][13]
S0538 Crutch

Crutch can monitor for removable drives being plugged into the compromised machine.[14]
S0673 DarkWatchman

DarkWatchman can list signed PnP drivers for smartcard readers.[15]
S0062 DustySky

DustySky can detect connected USB devices.[16]
G0020 Equation

Equation has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware.[17]
S0679 Ferocious

Ferocious can run GET.WORKSPACE in Microsoft Excel to check if a mouse is present.[18]
S0381 FlawedAmmyy

FlawedAmmyy will attempt to detect if a usable smart card is current inserted into a card reader.[19]
S1044 FunnyDream

The FunnyDream FilepakMonitor component can detect removable drive insertion.[20]
G0047 Gamaredon Group

Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.[21][22]
S1027 Heyoka Backdoor

Heyoka Backdoor can identify removable media attached to victim's machines.[23]
S1139 INC Ransomware

INC Ransomware can identify external USB and hard drives for encryption and printers to print ransom notes.[24]
S0283 jRAT

jRAT can map UPnP ports.[25]
S0409 Machete

Machete detects the insertion of new devices by listening for the WM_DEVICECHANGE window message.[26]

S1026 Mongall

Mongall can identify removable media attached to compromised hosts.[23]
S0149 MoonWind

MoonWind obtains the number of removable drives from the victim.[27]
S1090 NightClub

NightClub has the ability to monitor removable drives.[28]
S0385 njRAT

njRAT will attempt to detect if the victim system has a camera during the initial infection. njRAT can also detect any removable drives connected to the system.[29][30]
S0644 ObliqueRAT

ObliqueRAT can discover pluggable/removable drives to extract files from.[31]
G0049 OilRig

OilRig has used tools to identify if a mouse is connected to a targeted system.[32]
C0012 Operation CuckooBees

During Operation CuckooBees, the threat actors used the fsutil fsinfo drives command as part of their advanced reconnaissance.[33]
C0014 Operation Wocao

During Operation Wocao, threat actors discovered removable disks attached to a system.[34]
S0113 Prikormka

A module in Prikormka collects information on available printers and disk drives.[35]
S0650 QakBot

QakBot can identify peripheral devices on targeted systems.[36]
S0686 QuietSieve

QuietSieve can identify and search removable drives for specific file name extensions.[37]
S0481 Ragnar Locker

Ragnar Locker may attempt to connect to removable drives and mapped network drives.[38]
S0458 Ramsay

Ramsay can scan for removable media which may contain documents for collection.[39][40]

S1150 ROADSWEEP

ROADSWEEP can identify removable drives attached to the victim's machine.[11]
S0148 RTM

RTM can obtain a list of smart card readers attached to the victim.[41][42]
S1089 SharpDisco

SharpDisco has dropped a plugin to monitor external drives to C:\Users\Public\It3.exe.[28]
S0603 Stuxnet

Stuxnet enumerates removable drives for infection.[43]
S1064 SVCReady

SVCReady can check for the number of devices plugged into an infected host.[44]
S0098 T9000

T9000 searches through connected drives for removable storage devices.[45]
S0467 TajMahal

TajMahal has the ability to identify connected Apple devices.[46]
G0139 TeamTNT

TeamTNT has searched for attached VGA devices using lspci.[47]
S0647 Turian

Turian can scan for removable media to collect data.[5]
G0010 Turla

Turla has used fsutil fsinfo drives to list connected drives.[48]
S0452 USBferry

USBferry can check for connected USB devices.[49]
S0136 USBStealer

USBStealer monitors victims for insertion of removable drives. When dropped onto a second victim, it also enumerates drives connected to the system.[50]
G1017 Volt Typhoon

Volt Typhoon has obtained victim's screen dimension and display device information.[51]
S0366 WannaCry

WannaCry contains a thread that will attempt to scan for new attached drives every few seconds. If one is identified, it will encrypt the files on the attached device.[52]
S0612 WastedLocker

WastedLocker can enumerate removable drives prior to the encryption process.[53]
S0251 Zebrocy

Zebrocy enumerates information about connected storage devices.[54]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments that may attempt to gather information about attached peripheral devices and components connected to a computer system.
DS0009 Process OS API Execution

Monitor for API calls that may attempt to gather information about attached peripheral devices and components connected to a computer system.
Process Creation

Monitor for newly executed processes that may attempt to gather information about attached peripheral devices and components connected to a computer system.

References

  1. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
  2. Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.
  3. GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.
  4. Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.
  5. Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021
  6. Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.
  7. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  8. Galperin, E., Et al.. (2016, August). I Got a Letter From the Government the Other Day.... Retrieved April 25, 2018.
  9. Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016.
  10. Symantec Security Response. (2015, December 7). Iran-based attackers use back door threats to spy on Middle Eastern targets. Retrieved April 17, 2019.
  11. Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.
  12. Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.
  13. Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.
  14. Faou, M. (2020, December 2). Turla Crutch: Keeping the “back door” open. Retrieved December 4, 2020.
  15. Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.
  16. GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020.
  17. Kaspersky Lab's Global Research and Analysis Team. (2015, February). Equation Group: Questions and Answers. Retrieved December 21, 2015.
  18. Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
  19. Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
  20. Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.
  21. Kasza, A. and Reichel, D. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017.
  22. Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.
  23. Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.
  24. Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.
  25. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.
  26. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.
  27. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  1. Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.
  2. Fidelis Cybersecurity. (2013, June 28). Fidelis Threat Advisory #1009: "njRAT" Uncovered. Retrieved June 4, 2019.
  3. Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.
  4. Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021.
  5. Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.
  6. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.
  7. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  8. Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.
  9. Mendoza, E. et al. (2020, May 25). Qakbot Resurges, Spreads through VBS Files. Retrieved September 27, 2021.
  10. Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022.
  11. SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys virtual machine to dodge security. Retrieved June 29, 2020.
  12. Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.
  13. Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.
  14. Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  15. Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.
  16. Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved. 2017/09/22
  17. Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.
  18. Grunzweig, J. and Miller-Osborn, J.. (2016, February 4). T9000: Advanced Modular Backdoor Uses Complex Anti-Analysis Techniques. Retrieved April 15, 2016.
  19. GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.
  20. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.
  21. Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.
  22. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
  23. Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017.
  24. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.
  25. Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019.
  26. Walter, J.. (2020, July 23). WastedLocker Ransomware: Abusing ADS and NTFS File Attributes. Retrieved September 14, 2021.
  27. Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.