kevmap

TechniquesT1200 › AN0186

AN0186 Analytic 0186

Linux · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Chain: (1) udev / kernel logs show hot-plug (USB/Thunderbolt/PCIe); (2) block device created by udisks/diskarbitration; (3) optional: new network interface or DHCP lease observed. Correlate /var/log/messages|syslog, auditd SYSCALL open/creat on /dev, and DHCP/Zeek.</p>
Detects
T1200 Hardware Additions
Part of
DET0069 Detect unauthorized or suspicious Hardware Additions (USB/Thunderbolt/Network)

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
auditd:SYSCALLmknod,open,openatDC0042 Drive Creation
linux:syslogusb * new|thunderbolt|pci .* added|block.*: new .* deviceDC0038 Application Log Content
NSM:FlowLEASE_GRANTEDDC0078 Network Traffic Flow

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
BlocklistDeviceStringsIndicators such as 'RubberDucky', 'BadUSB', unfamiliar USB-NIC chipsets.
ServerClassesNoUSBHosts where any USB attach should alert (DCs, hypervisors).
DHCPVlanScopesScopes allowed to issue leases for corp endpoints vs. guest/IoT.