Skip to content

Peripheral Device Discovery

Technique · ATTACK:enterprise:T1120

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1120",
  "title": "Peripheral Device Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1120",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--348f1eef-964b-4eb6-bb53-69b3dcb0c643",
  "external_id": "T1120",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:28.471Z",
  "modified": "2026-05-12T15:12:00.624Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "Peripheral Discovery Linux",
      "url": "https://linuxhint.com/list-usb-devices-linux/"
    },
    {
      "source_name": "Peripheral Discovery macOS",
      "url": "https://ss64.com/osx/system_profiler.html"
    }
  ]
}

Explicit source assertions (58)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0225c7c8-db18-469d-a1aa-566900e297a7

Cybereason INC Ransomware November 2023

ATTACK:enterprise:G0020 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--062ebca3-abf7-449a-ad84-f04a3cada4dd

Kaspersky Equation QA

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0882cca9-ed77-4c71-85e4-78988d79236f

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09c8ec4f-c76b-4a36-994f-4ed4d87b7ad8

Securelist ScarCruft May 2019

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c93519a-28a4-4d29-99bc-02c4d0e53ae2

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0538 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e1de5dd-5f5c-4014-899b-0ab676322d80

ESET Crutch December 2020

ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1555866c-1eca-4de3-aded-d745fdd47d1c

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2afd76e6-335e-4769-8c2e-54b951753c2d

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30180ece-4504-4b6a-9182-5a2fbe3292df

Fidelis njRAT June 2013 · Trend Micro njRAT 2018

ATTACK:enterprise:S1026 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3146b7d3-26c9-47c4-b114-d39a4a786fc9

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:S0113 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33e0178f-c9b2-43db-9e63-3e664ae6bef0

ESET Operation Groundbait

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f58682a-dc04-40f6-b224-42bab6ef6f67

FireEye WannaCry 2017

ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45f3afcd-d0b7-494b-a61a-cad724dbf72a

Unit42 Cannon Nov 2018

ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45f9e4b6-a6a0-4f9f-aae9-9e8a69f5681d

ESET RTM Feb 2017 · Unit42 Redaman January 2019

ATTACK:enterprise:S0644 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--483772af-6fc0-487b-aa3f-4006253708b3

Talos Oblique RAT March 2021

ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5047ac79-8ed7-4f22-bfa2-fad8195f72b8

EFF Manul Aug 2016

ATTACK:enterprise:S1167 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52cf6f18-15b4-4cfe-9044-92beb5fd72d8

SentinelOne AcidPour 2024

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55d84559-7bb9-4e17-be60-7694e4219877

Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56d023cf-4390-40d9-afc6-cb0d40b4cdd1

Microsoft SIR Vol 19

ATTACK:enterprise:S0452 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57e57dc4-b813-4e5c-882a-0021c7e0ff22

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:S0149 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cceffd9-5818-4481-bce6-4e326548d6b4

Palo Alto MoonWind March 2017

ATTACK:enterprise:S0062 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62a7f7c2-435d-4ef6-aee3-add933fb241d

Kaspersky MoleRATs April 2019

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68ab9dc7-4258-439c-b011-945175476fb7

ESET Attor Oct 2019

ATTACK:enterprise:S1064 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69e4b520-6a9f-4dc0-b11e-805886ce8257

HP SVCReady Jun 2022

ATTACK:enterprise:S0679 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b15c0bd-7b39-408b-91fa-cf942a52a933

Kaspersky WIRTE November 2021

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7aac169b-e8ff-47fe-8649-ea09929c6605

FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7cac6ccb-d070-47da-8ebf-4034b0fddb7c

Securelist BlackEnergy Nov 2014

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7dd2714d-aa8a-40ce-bae1-98634090ac01

ESET ComRAT May 2020

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8dd1ec07-e429-473d-84db-125fd22ab709

Check Point APT34 April 2021

ATTACK:enterprise:S0115 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94a9ee1e-ac65-47aa-a8f4-6695f02d6040

Proofpoint Operation Transparent Tribe March 2016 · Kaspersky Transparent Tribe August 2020

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96640478-b6a5-40b6-8928-b1c0cc5ad3ef

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:S0381 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97361e60-4c54-48f6-a661-e3bd36b9745e

Proofpoint TA505 Mar 2018

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a0f1273a-e422-4801-a911-e7cb223ebea2

ESET Sednit Part 2

ATTACK:enterprise:S0612 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6959fa0-405c-49b9-983e-653569247dbd

Sentinel Labs WastedLocker July 2020

ATTACK:enterprise:S9038 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8bae6db-bf02-4e4e-93b0-140e8426b789

ESET DynoWiper JAN 2026

ATTACK:enterprise:S0686 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--adc3fbb4-955e-4861-ac19-4c2b546d562d

Microsoft Actinium February 2022

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--add3bfcd-3e6d-4978-9e2c-ac6fad18fc5a

Trend Micro Qakbot May 2020

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3f7d095-c7eb-4a4b-909d-e3b831c7ed16

FoxIT Wocao December 2019

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b71a28d8-a1b1-41b4-a0ac-f92bef513c6e

ESET Machete July 2019

ATTACK:enterprise:S1150 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb60e296-c3d9-4363-992d-90f61607553a

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be8f7d93-1de8-4376-bec9-4db0a15f7542

Cisco Talos Intelligence Group

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1632c73-7043-4aef-89f6-abbf6af676d2

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:S1090 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c596d308-22af-45db-9c72-2ce1b3695f90

MoustachedBouncer ESET August 2023

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1c69dc2-dce7-4f6e-a725-03aa8356b54d

DOJ Affidavit Search and Seizure PlugX December 2024

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d30d8fa0-7f24-41e5-ae8d-e4449e88d2f0

ESET Gamaredon June 2020 · Palo Alto Gamaredon Feb 2017 · ESET Gamaredon Sept2024

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6280c13-44e7-4046-bb53-a5f97cd25f43

Joint Cybersecurity Advisory LockBit 3.0 MAR 2023

ATTACK:enterprise:G0135 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d758de81-c572-45dc-94ed-67a4dc1da3fe

ESET BackdoorDiplomacy Jun 2021

ATTACK:enterprise:S1027 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de727da1-d36f-4e33-99a1-05ce2df29094

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:S0454 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dfdd269c-9d78-46da-8b31-3141a5398bfd

Symantec Chafer Dec 2015

ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea79bf34-c1ba-4523-879f-441d6a4a9e5e

Sophos Ragnar May 2020

ATTACK:enterprise:S0098 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea93ff11-939f-449a-a222-4273d9fc9f3c

Palo Alto T9000 Feb 2016

ATTACK:enterprise:S1230 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--edf938e4-8ea5-4be6-b4b4-68e00dfb14af

2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024

ATTACK:enterprise:S0467 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee1558f7-5b93-49c7-89c8-b3151cbefb84

Kaspersky TajMahal April 2019

ATTACK:enterprise:S1089 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eeb5eeab-3fa1-4670-a7ab-f6a8f7193be9

MoustachedBouncer ESET August 2023

ATTACK:enterprise:S0647 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0a42be5-d7ec-475e-a9cd-2c4728153bb8

ESET BackdoorDiplomacy Jun 2021

ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f7740e3c-c143-40b7-a8da-e797f5d74b50

ESET Sednit USBStealer 2014

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9c7d0e1-135f-4e21-8251-3049bc24c18d

Forcepoint Monsoon · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff2f9b25-f36a-4031-8013-1e746cc40948

Prevailion DarkWatchman 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.