tfMITRE ATT&CK sub-technique

Remote Access Hardware T1219.003

sub-technique of T1219 Remote Access Tools

Tactic: Command and Control
Platforms: Linux, macOS, Windows
Version: 1.0
Created: 26 March 2025
Last modified: 02 May 2025
Contributors: Joe Gumke, U.S. Bank; Shwetank Murarka; Michael Davis, ServiceNow Threat Intelligence

An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1219.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Remote Access Hardware detection strategy DET0159

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Remote Access via USB Hardware (TinyPilot, PiKVM)

Enterprise

3 platforms

AN0446 · Windows

Detection of USB-based remote access hardware (e.g., TinyPilot, PiKVM) attached to the host via drive or peripheral enumeration, triggering vendor identifiers or unusual EDID announcements.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Drive CreationDC0042	WinEventLog:System	EventCode=2003

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
VendorID	Device vendor strings may need tuning to include additional remote hardware sources.
SerialNumber	Serial numbers for known implants can vary per campaign and may need expansion.
TimeWindow	Adjust the detection window for peripheral enumeration based on environment and operating hours.

AN0447 · Linux

Insertion of USB-based hardware proxies (e.g., PiKVM) which register under predictable names (e.g., tinypilot) or mount under known paths (e.g., /opt/tinypilot-privileged).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Drive CreationDC0042	auditd:SYSCALL	udev events or drive enumeration involving TinyPilot paths or device classes

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FriendlyName	Different hardware may present differently; names like 'TinyPilot' may need expanding to cover custom implants.
MountPath	Path matching (e.g., /opt/tinypilot) is mutable based on distro, customization, and staging.

AN0448 · macOS

Attachment of hardware-backed USB KVM devices (e.g., TinyPilot) that enumerate new HID or serial communication interfaces with identifiable metadata.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Drive CreationDC0042	macos:unifiedlog	Hardware enumeration events via IOKit or USBMuxd showing TinyPilot or unknown keyboard/mouse

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DeviceClass	Input or HID devices may be benign or malicious depending on context; tune based on environment (e.g., BYOD/dev stations).
SerialCorrelationDepth	Correlating serials across multiple device insertions may reduce noise but requires tuning.

Remote Access Hardware detections T1219.003

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs