Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0491 — Peripheral Device Enumeration via System Utilities and API Calls
DET0491

Peripheral Device Enumeration via System Utilities and API Calls

3 analytic(s) · 1 technique(s) detected

Analytics

3
AN1353 Analytic 1353
Windows

Suspicious enumeration of attached peripherals via WMI, PowerShell, or low-level API calls potentially chained with removable device interactions.

WinEventLog:Security EventCode=4688 WinEventLog:Sysmon EventCode=10
[CommandLineRegex] Regex patterns for device enumeration utilities (e.g., 'Get-PnpDevice', 'wmic path Win32_USBController')
[TimeWindow] Time threshold for grouping device discovery with follow-on access or manipulation
[UserContext] Filter privileged or service accounts known to legitimately execute enumeration scripts
AN1354 Analytic 1354
Linux

Enumeration of USB and other peripheral hardware via udevadm, lshw, or /sys or /proc interfaces in proximity to collection or mounting behavior.

auditd:SYSCALL execve auditd:SYSCALL open/read linux:osquery hardware_events
[ExecutableList] Set of binaries used for peripheral enumeration (e.g., 'lshw', 'lsusb', 'udevadm')
[UserContext] Tuning based on which users/scripts are authorized to query device state
AN1355 Analytic 1355
macOS

Execution of system utilities like 'system_profiler' and 'ioreg' to enumerate hardware components or USB devices, particularly if followed by clipboard, file, or network activity.

macos:unifiedlog process exec macos:osquery usb_devices
[BinaryList] Commands like 'system_profiler SPUSBDataType', 'ioreg -p IOUSB' that may indicate enumeration
[TimeWindow] Temporal grouping of enumeration with follow-on activity (e.g., clipboard capture, exfiltration)

Detected Techniques

1

Details

MITRE ID
DET0491
STIX ID
x-mitre-detection-strategy--f273ee4a-e468-4a01-bb1a-f3a687518ded
Analytics
3
Techniques Detected
1
By Tactic
Discovery
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.