T1219.003 — Remote Access Hardware

Tactic: Command and Control · Platforms: Linux, macOS, Windows

An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be…

Sub-technique of Remote Access Tools (T1219).

Sigma detection rules (3)

T1219.003 Remote Access Tools: Remote Access Hardware

title: "T1219.003 Remote Access Tools: Remote Access Hardware"
id: 1ffa6582-4d26-4b2e-b4ed-50b3f269839c
description: 'Detects connection of known IP-KVM remote-access hardware (TinyPilot, PiKVM) via Security-log PNP device-recognition events. Genuine KVM hardware does not reliably self-identify by vendor string in every deployment, so this is a best-effort, name-based proxy rather than a comprehensive hardware inventory check; pair with a USB/peripheral device-control policy for full coverage. (Data Component: Drive Creation; baseline tier: windows-eventid.) Tune using: VendorID, SerialNumber, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1219/003
author: Shahrukh Khan
date: 2026-03-08
license: MIT
tags:
  - attack.command-and-control
  - attack.t1219.003

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: 6416
    ClassName: 'USB'
  keywords_hardware:
    DeviceDescription|contains:
      - 'TinyPilot'
      - 'PiKVM'
      - 'IP-KVM'
      - 'KVM'

  condition: selection and keywords_hardware

falsepositives:
  - Legitimate, organization-approved KVM/IP-KVM hardware used for authorized remote administration or lab/datacenter use.

level: medium

T1219.003 Remote Access Tools: Remote Access Hardware

title: "T1219.003 Remote Access Tools: Remote Access Hardware"
id: d39ed649-f67a-4298-b0d1-f61919410808
description: 'T1219.003 Remote Access Hardware (TinyPilot, PiKVM): true KVM-style remote-access hardware is identified by USB vendor/product ID and composite HID+video-capture device enumeration at the kernel/udev level -- attributes auditd file-event records (PATH/CREATE under /media) cannot see at all, since a mounted filesystem is indistinguishable from any ordinary USB drive. Linux auditd/journald has no native USB descriptor field, so this is retargeted to the closest defensible proxy: kernel-logged USB HID device attach events reported via journald/dmesg (product strings for known KVM-over-IP hardware) rather than generic /media mount activity. If journald/udev USB metadata is not centrally collected, this technique is effectively not observable with the current Linux telemetry and should be flagged for udev-monitoring onboarding rather than left as a tautological mount-point rule. Tune using: FriendlyName, USB VID/PID allowlist.'
references:
  - https://attack.mitre.org/techniques/T1219/003
author: Shahrukh Khan
date: 2026-05-28
license: MIT
tags:
  - attack.command-and-control
  - attack.t1219.003

logsource:
  product: linux
  service: journald

detection:
  selection_usb_hid_attach:
    - Message|contains: 'New USB device found'
    - Message|contains: 'usb-storage'
  selection_kvm_product_string:
    Message|contains:
      - 'TinyPilot'
      - 'PiKVM'
      - 'CH9329'
      - 'HDMI to USB'
  condition: selection_usb_hid_attach and selection_kvm_product_string

falsepositives:
  - Legitimate use of approved KVM-over-IP hardware for authorized out-of-band administration; maintain a VID/PID or FriendlyName allowlist of sanctioned devices.

level: low

T1219.003 Remote Access Tools: Remote Access Hardware

title: "T1219.003 Remote Access Tools: Remote Access Hardware"
id: 548de2ea-174e-4384-8ea1-86f2b6aad460
description: 'Detect Remote Access via USB Hardware (TinyPilot, PiKVM). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DeviceClass, SerialCorrelationDepth.'
references:
  - https://attack.mitre.org/techniques/T1219/003
author: Shahrukh Khan
date: 2026-02-22
license: MIT
tags:
  - attack.command-and-control
  - attack.t1219.003

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/USBAgent'
      - '/usbmuxd'
  condition: selection

falsepositives:
  - Physical remote access hardware such as USB attack implants or KVM-over-IP devices enumerate through the same USB and mux daemons as ordinary peripherals like iPhones and external drives, so unified log telemetry alone cannot distinguish device class without serial and vendor ID correlation.

level: low

Related sub-techniques

Explore