Remote Access Hardware
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
None of DET0159's three analytics puts an observable of remote access hardware on the monitored host. AN0446 (Windows) gives sigmaLogsource product=windows service=system with EventID 2003, but 2003 is not a System-channel event: USB device arrival 2003 (with 2100/2102) is emitted by Microsoft-Windows-DriverFrameworks-UserMode into its Operational channel, which Sigma models as service=driver-framework — the logsource SigmaHQ's own 'USB device plugged' rule uses. Copying the brief's logsource verbatim as hard rule 1 requires produces a selection on the System channel that can never fire; substituting driver-framework would break hard rule 1, and that channel is disabled by default and largely stopped emitting these events after Windows 7, so the substitution would not be safe either. […]
What the technique is
An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0446
Detection of USB-based remote access hardware (e.g., TinyPilot, PiKVM) attached to the host via drive or peripheral enumeration, triggering vendor identifiers or unusual EDID announcements.
- AN0447
Insertion of USB-based hardware proxies (e.g., PiKVM) which register under predictable names (e.g., tinypilot) or mount under known paths (e.g., /opt/tinypilot-privileged).
- AN0448
Attachment of hardware-backed USB KVM devices (e.g., TinyPilot) that enumerate new HID or serial communication interfaces with identifiable metadata.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.