Skip to content
Every technique
T1219.003No distinct observable

Remote Access Hardware

Command and ControlLinux, macOS, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

None of DET0159's three analytics puts an observable of remote access hardware on the monitored host. AN0446 (Windows) gives sigmaLogsource product=windows service=system with EventID 2003, but 2003 is not a System-channel event: USB device arrival 2003 (with 2100/2102) is emitted by Microsoft-Windows-DriverFrameworks-UserMode into its Operational channel, which Sigma models as service=driver-framework — the logsource SigmaHQ's own 'USB device plugged' rule uses. Copying the brief's logsource verbatim as hard rule 1 requires produces a selection on the System channel that can never fire; substituting driver-framework would break hard rule 1, and that channel is disabled by default and largely stopped emitting these events after Windows 7, so the substitution would not be safe either. […]

Covered instead by T1200, T1219.

What the technique is

An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).

Read it on attack.mitre.org

What MITRE says you would watch

  • AN0446

    Detection of USB-based remote access hardware (e.g., TinyPilot, PiKVM) attached to the host via drive or peripheral enumeration, triggering vendor identifiers or unusual EDID announcements.

  • AN0447

    Insertion of USB-based hardware proxies (e.g., PiKVM) which register under predictable names (e.g., tinypilot) or mount under known paths (e.g., /opt/tinypilot-privileged).

  • AN0448

    Attachment of hardware-backed USB KVM devices (e.g., TinyPilot) that enumerate new HID or serial communication interfaces with identifiable metadata.

Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.