Techniques › T1200 › AN0186
AN0186 Analytic 0186
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Chain: (1) udev / kernel logs show hot-plug (USB/Thunderbolt/PCIe); (2) block device created by udisks/diskarbitration; (3) optional: new network interface or DHCP lease observed. Correlate /var/log/messages|syslog, auditd SYSCALL open/creat on /dev, and DHCP/Zeek.</p>
- Detects
- T1200 Hardware Additions
- Part of
- DET0069 Detect unauthorized or suspicious Hardware Additions (USB/Thunderbolt/Network)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | mknod,open,openat | DC0042 Drive Creation |
| linux:syslog | usb * new|thunderbolt|pci .* added|block.*: new .* device | DC0038 Application Log Content |
| NSM:Flow | LEASE_GRANTED | DC0078 Network Traffic Flow |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
BlocklistDeviceStrings | Indicators such as 'RubberDucky', 'BadUSB', unfamiliar USB-NIC chipsets. |
ServerClassesNoUSB | Hosts where any USB attach should alert (DCs, hypervisors). |
DHCPVlanScopes | Scopes allowed to issue leases for corp endpoints vs. guest/IoT. |