Technique:  Peripheral Device Discovery
ADVSTORESHELL can list connected devices.
It uses a module to receive a notification every time a USB mass storage device is inserted into a victim.
It has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
Attor has a plugin that collects information about inserted storage devices, modems, and phone devices.
It has used an executable to detect removable media, such as USB flash drives.
BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.
Bandook can detect USB devices.
BlackEnergy can gather very specific information about attached USB devices, to include device instance ID and drive geometry.
Cadelspy has the ability to steal information about printers and the documents sent to printers.
Crimson has the ability to discover pluggable/removable drives to extract files from.
Crutch can monitor for removable drives being plugged into the compromised machine.
DarkWatchman can list signed PnP drivers for smartcard readers.
DustySky can detect connected USB devices.
It has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware.
Ferocious can run GET.WORKSPACE in Microsoft Excel to check if a mouse is present.
FlawedAmmyy will attempt to detect if a usable smart card is current inserted into a card reader.
The FunnyDream FilepakMonitor component can detect removable drive insertion.
It tools have contained an application to check performance of USB flash drives. It has also used malware to scan for removable drives.
Heyoka Backdoor can identify removable media attached to victim's machines.
jRAT can map UPnP ports.
It detects the insertion of new devices by listening for the WM_DEVICECHANGE window message.
Mongall can identify removable media attached to compromised hosts.
MoonWind obtains the number of removable drives from the victim.
NightClub has the ability to monitor removable drives.
njRAT will attempt to detect if the victim system has a camera during the initial infection. njRAT can also detect any removable drives connected to the system.
ObliqueRAT can discover pluggable/removable drives to extract files from.
It has used tools to identify if a mouse is connected to a targeted system.
During Operation CuckooBees, the threat actors used the fsutil fsinfo drives command as part of their advanced reconnaissance.
During Operation Wocao, threat actors discovered removable disks attached to a system.
A module in Prikormka collects information on available printers and disk drives.
QakBot can identify peripheral devices on targeted systems.
QuietSieve can identify and search removable drives for specific file name extensions.
Ragnar Locker may attempt to connect to removable drives and mapped network drives.
Ramsay can scan for removable media which may contain documents for collection.
It can obtain a list of smart card readers attached to the victim.
SharpDisco has dropped a plugin to monitor external drives to C:\Users\Public\It3.exe.
Stuxnet enumerates removable drives for infection.
SVCReady can check for the number of devices plugged into an infected host.
T9000 searches through connected drives for removable storage devices.
TajMahal has the ability to identify connected Apple devices.
It has searched for attached VGA devices using lspci.
Turian can scan for removable media to collect data.
It has used fsutil fsinfo drives to list connected drives.
USBferry can check for connected USB devices.
USBStealer monitors victims for insertion of removable drives. When dropped onto a second victim, it also enumerates drives connected to the system.
WannaCry contains a thread that will attempt to scan for new attached drives every few seconds. If one is identified, it will encrypt the files on the attached device.
WastedLocker can enumerate removable drives prior to the encryption process.
Zebrocy enumerates information about connected storage devices.