attack_technique: T1120
display_name: Peripheral Device Discovery
atomic_tests:
- name: Win32_PnPEntity Hardware Inventory
  auto_generated_guid: 2cb4dbf2-2dca-4597-8678-4d39d207a3a5
  description: Perform peripheral device discovery using Get-WMIObject Win32_PnPEntity
  supported_platforms:
  - windows
  executor:
    command: |-
      Get-WMIObject Win32_PnPEntity | Format-Table Name, Description, Manufacturer > $env:TEMP\T1120_collection.txt
      $Space,$Heading,$Break,$Data = Get-Content $env:TEMP\T1120_collection.txt
      @($Heading; $Break; $Data |Sort-Object -Unique) | ? {$_.trim() -ne "" } |Set-Content $env:TEMP\T1120_collection.txt
    cleanup_command: Remove-Item $env:TEMP\T1120_collection.txt -ErrorAction Ignore
    name: powershell
