T1200 Hardware Additions
EnterpriseAdversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused. While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. Adversary-in-the-Middle), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
mitigations
ATT&CK mitigations that reduce this.
detected by (8)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.AAIdentity Management, Authentication, and Access Controlmoderate · backed by 2 of 5 mapped controls
- ID.AMAsset Managementmoderate · backed by 1 of 5 mapped controls
- PR.DSData Securitymoderate · backed by 1 of 5 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (5)
Security controls that mitigate this.
attack patterns (1)
CAPEC attack patterns that exploit this.
groups (1)
Threat groups associated with this.
Detected by (Sigma) (3)
Sigma detection rules related to this.
source
Where this definition is published.