Remote access is not always software. MITRE ATT&CK tracks hardware based remote control as T1219.003, Remote Access Hardware, in the Command and Control tactic. It applies to Linux, macOS and Windows.
How attackers use it
MITRE describes IP based keyboard, video and mouse (KVM) devices such as TinyPilot and PiKVM. These are common, legitimate tools and may be allowed by peripheral device policies. An adversary can physically install one after compromise as an alternate communications channel, or to open an interactive remote session on the target system. Because it is hardware, it may let threat actors bypass software security solutions and gain more control over the compromised device.
How to detect it
The MITRE analytics focus on the host side of the device. Watch for USB remote access hardware attached to a host, shown through drive or peripheral enumeration with vendor identifiers or unusual EDID announcements. On Linux, MITRE mentions devices that register under predictable names such as tinypilot, or mount under known paths. Look also for new HID or serial communication interfaces with identifiable metadata.
Practically, that means collecting USB device insertion events and comparing them with an approved device list.
How to reduce the risk
MITRE lists one mitigation: block the use of IP based KVM devices in the network if they are not required. Pair that with physical access controls on servers and workstations.
Quick check
Why can this technique bypass software security tools?
The remote control happens through hardware that presents itself as a keyboard, video and mouse path, outside the software the tools monitor.
Sources
- MITRE ATT&CK, T1219.003: https://attack.mitre.org/techniques/T1219/003
