// MITRE ATT&CK
T1200 · Hardware Additions
Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. [Replication Through Removable Media](htt...
How to detect & mitigate it
Detecting Hardware Additions starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1195.001
Compromise Software Dependencies and Development Tools T1566.002
Spearphishing Link T1566.001
Spearphishing Attachment T1195.003
Compromise Hardware Supply Chain T1195
Supply Chain Compromise T1190
Exploit Public-Facing Application T1659
Content Injection T1199
Trusted Relationship
Compromise Software Dependencies and Development Tools T1566.002
Spearphishing Link T1566.001
Spearphishing Attachment T1195.003
Compromise Hardware Supply Chain T1195
Supply Chain Compromise T1190
Exploit Public-Facing Application T1659
Content Injection T1199
Trusted Relationship
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.