T1120

Description from ATT&CK

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.

Tests

Test #1 - Find removable storage devices using System Events

This test uses System Events to find all connected removable storage devices.

tell application "System Events" to get name of every disk whose ejectable is true

Download Files

Test #2 - Find removable storage devices using Finder

This test uses Finder to find all connected removable storage devices.

tell application "Finder" to get name of every disk whose ejectable is true

Download Files

Test #3 - Find all devices using System Information

This test uses System Information to find all connected devices (bluetooth, wifi, disks, application versions, etc.).

tell application "System Information" to get properties

Download Files

References

• MITRE ATT&CK T1120
• Apple Script Language Guide