Detect Remote Access Hardware in Splunk
An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1219 Remote Access Tools
- Sub-technique
- T1219.003 Remote Access Hardware
- Canonical reference
- https://attack.mitre.org/techniques/T1219/003/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
(DestinationPort=5900 OR DestinationPort=5901 OR DestinationPort=623 OR DestinationPort=5000 OR DestinationPort=8443 OR DestinationPort=8888)
(DestinationIp="192.168.*" OR DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="172.17.*" OR DestinationIp="172.18.*" OR DestinationIp="172.19.*" OR DestinationIp="172.2*" OR DestinationIp="172.3*")
| eval IsVNCPort=if(DestinationPort==5900 OR DestinationPort==5901, "Yes", "No")
| eval IsIPMIPort=if(DestinationPort==623, "Yes", "No")
| eval IsWebKVM=if(DestinationPort==8443 OR DestinationPort==8888 OR DestinationPort==5000, "Yes", "No")
| eval ConnectionType=case(
IsVNCPort=="Yes", "VNC/KVM",
IsIPMIPort=="Yes", "IPMI",
IsWebKVM=="Yes", "Web-based KVM",
1=1, "Other")
| stats count as Connections, dc(DestinationIp) as UniqueKVMDevices, values(DestinationPort) as Ports, earliest(_time) as FirstSeen, latest(_time) as LastSeen by host, User, Image, ConnectionType
| where Connections > 1
| sort - ConnectionsDetects network connections to KVM-over-IP hardware management ports using Sysmon Network Connection events (Event ID 3). Identifies VNC ports (5900/5901) used by TinyPilot and PiKVM, IPMI port (623) used by server BMCs, and web-based KVM ports (8443/8888/5000). Categorizes connection types and aggregates by source host to identify systems communicating with multiple KVM devices, which may indicate an adversary using hardware-based remote access across multiple targets.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Data center administrators using iDRAC/iLO/IPMI for legitimate out-of-band server management
- IT operations using rack KVM switches for routine server console access
- Network engineers accessing serial console servers for network device management
- Monitoring tools polling IPMI/iLO interfaces for hardware health checks
Other platforms for T1219.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1IPMI Interface Discovery via ipmitool
Expected signal: Sysmon Event ID 1: PowerShell process creation with Test-NetConnection command. Sysmon Event ID 3: Network connection attempt to 192.168.1.1:623. The connection will likely fail (no IPMI target) but the network connection event still fires showing the port 623 probe.
- Test 2VNC Port Scan Simulation for KVM Discovery
Expected signal: Sysmon Event ID 1: PowerShell process creation. Sysmon Event ID 3: Network connection attempts to 192.168.1.1-5 on port 5900. Multiple connection events to different IPs on VNC port indicates scanning behavior.
- Test 3USB HID Device Enumeration Check
Expected signal: Sysmon Event ID 1: PowerShell process creation with Get-PnpDevice command line. PowerShell ScriptBlock Log Event ID 4104 with the WMI/PnP query content. No network events expected — this is a local enumeration test.
References (8)
- https://attack.mitre.org/techniques/T1219/003/
- https://unit42.paloaltonetworks.com/north-korean-it-workers/
- https://cloud.google.com/blog/topics/threat-intelligence/mitigating-dprk-it-worker-threat/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a
- https://pikvm.org/
- https://tinypilotkvm.com/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://www.dell.com/support/kbdoc/en-us/000178115/idrac-9-security-configuration-guide
Unlock Pro Content
Get the full detection package for T1219.003 including response playbook, investigation guide, and atomic red team tests.