---
{
  "title": "Hardware Additions",
  "summary": "Hardware additions introduce devices that can create an unauthorized access or collection path.",
  "topic": "soc",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    6
  ],
  "aliases": [
    "T1200"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1200: Hardware Additions",
      "url": "https://attack.mitre.org/techniques/T1200"
    }
  ],
  "editorialVersion": 2
}
---

## A new device can introduce a new path

Hardware additions introduce physical devices that create an unauthorized access, communication, or collection opportunity. The device may attach to a computer or network and provide capabilities beyond ordinary removable storage. The risk depends on its functions, connectivity, placement, and the trust granted by the environment.

New hardware is common in normal work. Docking stations, accessibility devices, adapters, and replacement equipment appear routinely. A useful investigation establishes the device's identity, owner, purpose, connection history, and observed behavior rather than treating unfamiliar equipment as automatically hostile.

## An unexplained network device

In a fictional office, administrators discover a small device connected to a network port with no matching inventory entry. The responder documents its location, visible connections, identifying details, and relevant network observations through the approved process.

The device might belong to a legitimate facilities or support project. The team checks installation records and responsible owners before making conclusions. A manufacturer label or familiar enclosure does not establish the device's actual configuration or purpose.

Network evidence can show addresses, authentication, and communication under the relevant monitoring coverage. It may not reveal every physical capability or locally stored artifact. Avoid casually connecting an unknown device to a normal workstation for inspection.

## Consider physical and logical context

Where the device was placed matters. Access to an unrestricted guest network differs from access to a sensitive management segment. Review port configuration, network admission, reachable services, and any host interaction supported by evidence.

[[network-segmentation]] helps explain the boundary the device encountered. [[replication-through-removable-media]] concerns a different path involving storage-carried content, although one physical device may have several functions.

Preserve the physical device and relevant records appropriately if an investigation is required. Document handling and changes, especially before disconnecting power or communication when volatile information may matter. Ongoing harm can still justify immediate isolation, with the tradeoff recorded.

## Remove the unauthorized path safely

Coordinate with network and facilities owners to restrict access, identify dependencies, and investigate affected resources. Removing the device stops one visible path but does not establish what happened while it was connected.

Review how it was introduced and whether inventory, physical access, or network admission processes need improvement. Avoid replacing investigation with a blanket claim that all unknown hardware caused compromise.

For practice, compare an unregistered approved adapter with a fictional device making unexplained connections on a restricted segment. Identify the ownership, installation, network, and handling evidence needed for a decision. [[digital-forensics]] supports preservation, and [[incident-reporting]] separates confirmed presence from suspected capabilities or impact.

## Related concepts

- [[mitre-attack]]
- [[logs-and-telemetry]]
- [[incident-response]]