CAPEC-646: Peripheral Footprinting
Description
Adversaries may attempt to obtain information about attached peripheral devices and components connected to a computer system. Examples may include discovering the presence of iOS devices by searching for backups, analyzing the Windows registry to determine what USB devices have been connected, or infecting a victim system with malware to report when a USB device has been connected. This may allow the adversary to gain additional insight about the system or network environment, which may be useful in constructing further attacks.
- Likelihood of attack
- Low
- Typical severity
- Medium
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Collect and Analyze Information
Prerequisites
- The adversary needs either physical or remote access to the victim system.
Skills required
- MediumThe adversary needs to be able to infect the victim system in a manner that gives them remote access.
- MediumIf analyzing the Windows registry, the adversary must understand the registry structure to know where to look for devices.
Mitigations
- Identify programs that may be used to acquire peripheral information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.