---
type: "mapping-set"
title: "Sigma rules → #8 Physical Attack"
description: "2 Sigma rules entries mapped to TLCTC #8 Physical Attack."
resource: "tlctc:mapping:sigma:cluster-8"
tags:
  - "mapping"
  - "sigma"
  - "cluster-8"
---
# Sigma rules → #8 Physical Attack

> Source: SigmaHQ rules → TLCTC mapping (`mappings/sigma/`). Derived via ATT&CK technique mapping.

Mapped entries: **2**. Cluster: [#8 Physical Attack](/clusters/cluster-8.md).

| Rule | Techniques | Cluster set | Status |
|---|---|---|---|
| USB Device Plugged | T1200 | #8 | ok |
| Device Installation Blocked | T1200 | #8 | ok |