Peripheral Device Discovery
Peripheral discovery identifies attached devices that can reveal a host's role or collection opportunities.
What it means
Peripheral discovery identifies attached devices that can reveal a host's role or collection opportunities. Devices include storage, cameras, microphones, and other components.
An investigation example
An unfamiliar process inventories connected cameras and removable storage before further collection activity.
Evidence to examine
Review device queries, process ancestry, attached-device history, and subsequent access to identified peripherals.
A common analytical pitfall
Device enumeration is not equivalent to activating a camera or copying removable storage.
Response considerations
Preserve the discovery sequence and verify whether any identified devices were actually used for unauthorized operations.
Attached devices can describe a host's role
Information about connected storage, cameras, printers, and other peripherals can reveal how a computer is used and what collection opportunities exist. The meaning depends on the device and workflow. Discovering a camera does not prove that it was activated, and finding removable storage does not prove files were copied to it.
Inventory tools and operating-system services legitimately enumerate devices. Investigators should connect the query to its requesting process, account, and subsequent behavior. Device identifiers can be useful, but naming and reassignment may complicate interpretation. Preserve the source and observation time rather than assume the same peripheral remained attached throughout the incident.
A fictional removable-storage lead
An academy's endpoint records show an unfamiliar process checking attached devices shortly before file activity involving removable storage. Analysts compare device events, file operations, process ancestry, and approved support work. They distinguish the existence of a storage device from evidence of specific content being written to it.
Collection and reporting should remain proportionate. Peripheral information can reveal user context or sensitive operational arrangements. If the relevant logs are incomplete, state the gap instead of using the device's presence to fill in a desired narrative. A later physical inspection may show current attachment but not establish the earlier state.
Compare three claims
Create fictional events for device enumeration, device attachment, and a file write. Write the narrow claim supported by each. Then identify the evidence needed to connect the file write to a particular removable device. The exercise develops a clear progression from discovery to use without requiring unauthorized monitoring or copying information from real external drives.
Device enumeration may return logical or previously known devices as well as currently usable hardware, depending on the source. Check the API or artifact semantics before calling every listed peripheral physically present. That distinction is especially important when interpreting removable storage or virtual devices in a reconstructed host timeline.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1120: Peripheral Device Discovery