# T1200 - Hardware Additions

## SOC Recommendation
Investigate Hardware Additions activity in the context of Initial Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Radiation Hardening | Harden | Apply Radiation Hardening to reduce this technique's viability before an incident occurs. |
| Hardware Component Inventory | Model | Use Hardware Component Inventory to establish a baseline that makes this technique's deviations easier to spot. |

## Investigation Steps
1. Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.
2. Check whether activity aligns with a planned change or approved business process.
3. Identify all affected users/devices/resources over the prior 24 hours.
4. Determine whether this is isolated or part of a broader campaign.
5. Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.
6. Elevate severity if privileged identities, critical systems, or repeated activity is observed.
7. Capture all evidence (query results, entities, timeline) in the incident record.
8. Route to the appropriate response playbook and customer escalation path.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain impacted identities/endpoints/sessions based on obse | Low | No | Yes |
| Block malicious indicators (IP, URL, domain, hash) where ava | Medium | No | Yes |
| Complete blast radius analysis across related logs and entit | Low | No | Yes |
| Notify stakeholders according to incident priority and custo | Low | Yes | No |
| Remove persistence or unauthorized access paths identified d | Low | No | Yes |
| Capture lessons learned and update rule tuning/watchlists. | Low | No | Yes |

## KQL
```kql
let threshold = 1000;
Infoblox
| where ProcessName =~ "dhcpd" and Log_Type =~ "DHCPREQUEST"
| summarize count() by SrcIpAddr, bin(TimeGenerated,5m)
| where count_ > threshold
| join kind=inner (Infoblox
    | where ProcessName =~ "dhcpd" and Log_Type =~ "DHCPREQUEST"
    ) on SrcIpAddr
```
```kql
// UniFi New Device Adopted Detection
Unifi_SiteManager_Devices_CL
| where TimeGenerated > ago(1h)
| where isnotempty(AdoptionTime)
| extend AdoptionDateTime = todatetime(AdoptionTime)
| where AdoptionDateTime > ago(1h)
| summarize arg_max(TimeGenerated, *) by Id
| extend
    DeviceName = coalesce(Name, "Unnamed"),
    DeviceId = Id,
    Model = Model,
    IPAddress = Ip,
    MACAddress = Mac,
    ProductLine = ProductLine,
    FirmwareVersion = Version,
    Shortname = Shortname
| extend HostName = DeviceName
| project
    TimeGenerated,
    AdoptionTime = AdoptionDateTime,
    DeviceName,
    DeviceId,
    Model,
    IPAddress,
    MACAddress,
    ProductLine,
    Status = Status,
    FirmwareVersion,
    Shortname,
    HostName
```

## Escalation Criteria
- Hardware Additions activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners
- Security testing or red-team exercise — Source identity/host matches approved test plan

Generated by SOC Response Atlas by Basyrix.