T1120: T1120
Essential information
- MITRE technique ID
T1120- Confidence
- 100/100
- Revoked
- No
- Published
- 31/05/2017 23:31
- Modified
- 27/03/2026 01:09
- Author / Source
- The MITRE Corporation
Aliases
Peripheral Device Discovery
Platforms
windows macos linux
Description
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-attack | discovery |
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.
Intrusion sets (APT) (18)
-
Equation usesThe MITRE Corporation Confidence 100
[Equation](https://attack.mitre.org/groups/G0020) is a sophisticated threat group that employs multiple remote access tools. The group is known to use zero-day exploits and has developed the capability to overwrite the…
First seen 01/01/1970 · Last seen 16/11/5138 · -
The MITRE Corporation Confidence 100
[Kimsuky](https://attack.mitre.org/groups/G0094) is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter…
First seen 01/01/1970 · Last seen 16/11/5138 · -
TeamTNT usesThe MITRE Corporation Confidence 100
[TeamTNT](https://attack.mitre.org/groups/G0139) is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its…
First seen 01/01/1970 · Last seen 16/11/5138 · -
BackdoorDiplomacy relatedThe MITRE Corporation Confidence 100
[BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) is a cyber espionage threat group that has been active since at least 2017. [BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) has targeted Ministries of Foreign Affairs and telecommunication companies in Africa, Europe,…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Doppelgänger relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
PhantomCaptcha relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Malware (83)
-
Tick usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
XMRig usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Crimson usesFamily The MITRE Corporation Confidence 100
[Crimson](https://attack.mitre.org/software/S0115) is a remote access Trojan that has been used by [Transparent Tribe](https://attack.mitre.org/groups/G0134) since at least 2016.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)
First seen 01/01/1970 · Last seen 16/11/5138 · -
ADVSTORESHELL usesFamily The MITRE Corporation Confidence 100
[ADVSTORESHELL](https://attack.mitre.org/software/S0045) is a spying backdoor that has been used by [APT28](https://attack.mitre.org/groups/G0007) from at least 2012 to 2016. It is generally used for long-term espionage and is deployed on…
First seen 01/01/1970 · Last seen 16/11/5138 · -
SlowStepper usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Machete usesFamily The MITRE Corporation Confidence 100
[Machete](https://attack.mitre.org/software/S0409) is a cyber espionage toolset used by [Machete](https://attack.mitre.org/groups/G0095). It is a Python-based backdoor targeting Windows machines that was first observed in 2010.(Citation: ESET Machete July 2019)(Citation: Securelist…
First seen 01/01/1970 · Last seen 16/11/5138 · -
HIUPAN usesFamily The MITRE Corporation Confidence 100
[HIUPAN](https://attack.mitre.org/software/S1230) (aka U2DiskWatch) is a is a worm that propagates through removable drives known to be leveraged by [Mustang Panda](https://attack.mitre.org/groups/G0129) and was first observed utilized in 2024. (Citation:…
First seen 01/01/1970 · Last seen 16/11/5138 · -
ROADSWEEP usesFamily The MITRE Corporation Confidence 100
[ROADSWEEP](https://attack.mitre.org/software/S1150) is a ransomware that was deployed against Albanian government networks during [HomeLand Justice](https://attack.mitre.org/campaigns/C0038) along with the [CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) backdoor.(Citation: Mandiant ROADSWEEP August 2022)
First seen 01/01/1970 · Last seen 16/11/5138 · -
Turian usesFamily The MITRE Corporation Confidence 100
[Turian](https://attack.mitre.org/software/S0647) is a backdoor that has been used by [BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) to target Ministries of Foreign Affairs, telecommunication companies, and charities in Africa, Europe, the Middle East, and Asia.…
First seen 01/01/1970 · Last seen 16/11/5138 · -
W32.Stuxnet usesThe MITRE Corporation Confidence 100
[Stuxnet](https://collaborate.mitre.org/attackics/index.php/Software/S0010) was the first publicly reported piece of malware to specifically target industrial control systems devices. Stuxnet is a large and complex piece of malware that utilized multiple…
First seen 01/01/1970 · Last seen 16/11/5138 · -
GHOSTKNIFE usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
DustySky usesFamily The MITRE Corporation Confidence 100
[DustySky](https://attack.mitre.org/software/S0062) is multi-stage malware written in .NET that has been used by [Molerats](https://attack.mitre.org/groups/G0021) since May 2015. (Citation: DustySky) (Citation: DustySky2)(Citation: Kaspersky MoleRATs April 2019)
First seen 01/01/1970 · Last seen 16/11/5138 ·
Reports (17)
-
1 CVE 15 MITREs 2 Malwares 4 Observables
-
6 CVEs 19 MITREs 3 Malwares 4 Observables
-
1 CVE 21 MITREs 1 Malware 1 APT
-
24 MITREs 4 Malwares 1 APT
-
32 MITREs 1 Malware 1 APT
-
22 MITREs 6 Malwares 200 Observables 1 APT
-
11 MITREs
-
18 MITREs 13 Observables 1 APT
-
19 MITREs 1 Malware 1 Observable
-
13 MITREs 3 Malwares 2 Observables
-
19 MITREs 1 Malware 1 Observable
-
19 MITREs 200 Observables 1 APT
Vulnerabilities (CVE) (11)
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) …
- Attack vector
- NETWORK
- Published
- 05/01/2026
- Modified
- 19/03/2026
Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.
- Attack vector
- LOCAL
- Published
- 14/01/2025
- Modified
- 21/12/2025
Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of …
- Attack vector
- Network
- Published
- 12/12/2025
- Modified
- 18/03/2026
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, watchOS 11.6, visionOS 2.6, iOS 18.6 and …
- Attack vector
- Network
- Complexity
- LOW
- Published
- 30/07/2025
- Modified
- 02/07/2026
A memory corruption issue was addressed with improved lock state checking. This issue is fixed in watchOS 26.1, iOS 18.7.2 and iPadOS …
- Attack vector
- Local
- Complexity
- LOW
- Published
- 12/12/2025
- Modified
- 04/04/2026
A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 26.2, Safari 26.2, iOS 18.7.3 and iPadOS …
- Attack vector
- NETWORK
- Complexity
- LOW
- Published
- 15/12/2025
- Modified
- 04/04/2026
Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative …
- Attack vector
- Network
- Published
- 11/10/2022
- Modified
- 14/01/2026
Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a …
- Attack vector
- NETWORK
- Published
- 07/01/2026
- Modified
- 09/03/2026
Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that …
- Attack vector
- Local
- EPSS
- 0.0001 (P0.6%)
- Published
- 12/02/2026
- Modified
- 18/03/2026
A memory corruption issue was addressed with improved memory handling. This issue is fixed in watchOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, …
- Attack vector
- LOCAL
- Complexity
- LOW
- Published
- 12/12/2025
- Modified
- 04/04/2026
Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.
- Attack vector
- Local
- Complexity
- Low
- Published
- 15/11/2017
- Modified
- 29/05/2026
Campaign (2)
-
Operation Wocao uses
-
Operation CuckooBees uses