T1219.003sub-technique of T1219 Remote Access Tools
Remote Access Hardware
Linux · macOS · Windowsnothing on this site yetT1219.003 on attack.mitre.org
An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment.
how MITRE says to see it
Detect Remote Access via USB Hardware (TinyPilot, PiKVM)
- Detection of USB-based remote access hardware (e.g., TinyPilot, PiKVM) attached to the host via drive or peripheral enumeration, triggering vendor identifiers or unusual EDID announcements.
- Insertion of USB-based hardware proxies (e.g., PiKVM) which register under predictable names (e.g., tinypilot) or mount under known paths (e.g., /opt/tinypilot-privileged).
- Attachment of hardware-backed USB KVM devices (e.g., TinyPilot) that enumerate new HID or serial communication interfaces with identifiable metadata.
what reduces it
- M1034 Limit Hardware Installation. Block the use of IP-based KVM devices within the network if they are not required.