T1200Initial Access
Hardware Additions
Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a…
CVEs3
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.2
Reports1
Detections
3 Sigma rules tagged T1200Hardware AdditionsT12003 general rules
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Hardware Additions
3 CVEs, by priority. Each link shows its badge.- CVE-2015-1769Microsoft Windows Mount Manager Privilege Escalation VulnerabilityMicrosoft · WindowsKEVPublic exploitMedium · 6.6T1200Hardware AdditionsT1068Exploitation for Privilege Escalation1 reportAI mapping from the description · how it is exploited4.1%Top 9.3%69.6priority
- CVE-2025-24984Microsoft Windows NTFS Information Disclosure VulnerabilityAI mapping from the description · how it is exploited2.0%Top 19%57.4priority
- CVE-2019-3717Select Dell Client Commercial and Consumer platforms contain an Improper Access VulnerabilityDell · Dell Client Commercial and Consumer platformsHigh · 7.1T1200Hardware AdditionsT1548Abuse Elevation Control MechanismMITRE CTID mapping of the CVE · how it is exploited0.4%Top 70%11.0priority