T1200 — Hardware Additions

# T1200 - Hardware Additions

## SOC Recommendation
Investigate Hardware Additions activity in the context of Initial Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Radiation Hardening | Harden | Apply Radiation Hardening to reduce this technique's viability before an incident occurs. |
| Hardware Component Inventory | Model | Use Hardware Component Inventory to establish a baseline that makes this technique's deviations easier to spot. |

## Investigation Steps
1. Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.
2. Check whether activity aligns with a planned change or approved business process.
3. Identify all affected users/devices/resources over the prior 24 hours.
4. Determine whether this is isolated or part of a broader campaign.
5. Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.
6. Elevate severity if privileged identities, critical systems, or repeated activity is observed.
7. Capture all evidence (query results, entities, timeline) in the incident record.
8. Route to the appropriate response playbook and customer escalation path.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain impacted identities/endpoints/sessions based on obse | Low | No | Yes |
| Block malicious indicators (IP, URL, domain, hash) where ava | Medium | No | Yes |
| Complete blast radius analysis across related logs and entit | Low | No | Yes |
| Notify stakeholders according to incident priority and custo | Low | Yes | No |
| Remove persistence or unauthorized access paths identified d | Low | No | Yes |
| Capture lessons learned and update rule tuning/watchlists. | Low | No | Yes |

## KQL
```kql
let threshold = 1000;
Infoblox
| where ProcessName =~ "dhcpd" and Log_Type =~ "DHCPREQUEST"
| summarize count() by SrcIpAddr, bin(TimeGenerated,5m)
| where count_ > threshold
| join kind=inner (Infoblox
    | where ProcessName =~ "dhcpd" and Log_Type =~ "DHCPREQUEST"
    ) on SrcIpAddr
```
```kql
// UniFi New Device Adopted Detection
Unifi_SiteManager_Devices_CL
| where TimeGenerated > ago(1h)
| where isnotempty(AdoptionTime)
| extend AdoptionDateTime = todatetime(AdoptionTime)
| where AdoptionDateTime > ago(1h)
| summarize arg_max(TimeGenerated, *) by Id
| extend
    DeviceName = coalesce(Name, "Unnamed"),
    DeviceId = Id,
    Model = Model,
    IPAddress = Ip,
    MACAddress = Mac,
    ProductLine = ProductLine,
    FirmwareVersion = Version,
    Shortname = Shortname
| extend HostName = DeviceName
| project
    TimeGenerated,
    AdoptionTime = AdoptionDateTime,
    DeviceName,
    DeviceId,
    Model,
    IPAddress,
    MACAddress,
    ProductLine,
    Status = Status,
    FirmwareVersion,
    Shortname,
    HostName
```

## Escalation Criteria
- Hardware Additions activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners
- Security testing or red-team exercise — Source identity/host matches approved test plan

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1200.json
• /api/recommendations/T1200.json
• /api/d3fend/T1200.json
• /api/mappings/T1200.json
• /api/confluence/T1200.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1200.json

Response:

{
  "technique_id": "T1200",
  "name": "Hardware Additions",
  "priority": "low",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Initial Access"
  ],
  "platforms": [
    "Windows",
    "Linux",
    "macOS"
  ],
  "summary": "Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091)), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused...",
  "soc_recommendation": "Investigate Hardware Additions activity in the context of Initial Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-RH",
      "name": "Radiation Hardening",
      "relationship": "harden",
      "practical_action": "Apply Radiation Hardening to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-HCI",
      "name": "Hardware Component Inventory",
      "relationship": "model",
      "practical_action": "Use Hardware Component Inventory to establish a baseline that makes this technique's deviations easier to spot.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.",
      "Check whether activity aligns with a planned change or approved business process.",
      "Identify all affected users/devices/resources over the prior 24 hours.",
      "Determine whether this is isolated or part of a broader campaign.",
      "Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.",
      "Elevate severity if privileged identities, critical systems, or repeated activity is observed.",
      "Capture all evidence (query results, entities, timeline) in the incident record.",
      "Route to the appropriate response playbook and customer escalation path."
    ],
    "generic": [
      "Confirm whether the observed hardware additions activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Potential DHCP Starvation Attack\" -- This creates an incident in the event that an excessive amount of DHCPREQUEST have been recieved by a DHCP Server and could potentially be an indication of a DHCP Starvation Attack.'"
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain impacted identities/endpoints/sessions based on obse",
      "category": "Containment",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Contain impacted identities/endpoints/sessions based on observed behavior."
    },
    {
      "name": "Block malicious indicators (IP, URL, domain, hash) where ava",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Block malicious indicators (IP, URL, domain, hash) where available."
    },
    {
      "name": "Complete blast radius analysis across related logs and entit",
      "category": "Eradication",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Complete blast radius analysis across related logs and entities."
    },
    {
      "name": "Notify stakeholders according to incident priority and custo",
      "category": "Eradication",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide",
      "notes": "Notify stakeholders according to incident priority and customer SLA."
    },
    {
      "name": "Remove persistence or unauthorized access paths identified d",
      "category": "Recovery",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Remove persistence or unauthorized access paths identified during investigation."
    },
    {
      "name": "Capture lessons learned and update rule tuning/watchlists.",
      "category": "Recovery",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "57e56fc9-417a-4f41-a579-5475aea7b8ce — Potential DHCP Starvation Attack",
        "description": "This creates an incident in the event that an excessive amount of DHCPREQUEST have been recieved by a DHCP Server and could potentially be an indication of a DHCP Starvation Attack.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let threshold = 1000;\nInfoblox\n| where ProcessName =~ \"dhcpd\" and Log_Type =~ \"DHCPREQUEST\"\n| summarize count() by SrcIpAddr, bin(TimeGenerated,5m)\n| where count_ > threshold\n| join kind=inner (Infoblox\n    | where ProcessName =~ \"dhcpd\" and Log_Type =~ \"DHCPREQUEST\"\n    ) on SrcIpAddr"
      },
      {
        "name": "e69be544-9476-35bb-2533-fa8c650dcd46 — UniFi Site Manager: New Device Adopted",
        "description": "Identifies when a new device is adopted into the UniFi network. While often legitimate, unexpected adoptions may indicate unauthorized hardware additions. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "// UniFi New Device Adopted Detection\nUnifi_SiteManager_Devices_CL\n| where TimeGenerated > ago(1h)\n| where isnotempty(AdoptionTime)\n| extend AdoptionDateTime = todatetime(AdoptionTime)\n| where AdoptionDateTime > ago(1h)\n| summarize arg_max(TimeGenerated, *) by Id\n| extend\n    DeviceName = coalesce(Name, \"Unnamed\"),\n    DeviceId = Id,\n    Model = Model,\n    IPAddress = Ip,\n    MACAddress = Mac,\n    ProductLine = ProductLine,\n    FirmwareVersion = Version,\n    Shortname = Shortname\n| extend HostName = DeviceName\n| project\n    TimeGenerated,\n    AdoptionTime = AdoptionDateTime,\n    DeviceName,\n    DeviceId,\n    Model,\n    IPAddress,\n    MACAddress,\n    ProductLine,\n    Status = Status,\n    FirmwareVersion,\n    Shortname,\n    HostName"
      }
    ],
    "spl": [],
    "esql": []
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Hardware Additions activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners",
    "Security testing or red-team exercise — Source identity/host matches approved test plan"
  ],
  "confluence": {
    "title": "T1200 - Hardware Additions Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}