Prevent unauthorized users or groups from installing or using hardware, such as external drives, peripheral devices, or unapproved internal hardware components, by enforcing hardware usage policies and technical controls. This includes disabling USB ports, restricting driver installation, and implementing endpoint security tools to monitor and block unapproved devices. This mitigation can be implemented through the following measures: Disable USB Ports and Hardware Installation Policies: - Use Group Policy Objects (GPO) to disable USB mass storage devices: - Navigate to Computer Configuration > Administrative Templates > System > Removable Storage Access. - Deny write and read access to USB devices. - Whitelist approved devices using unique serial numbers via Windows Device Installation Policies. Deploy Endpoint Protection and Device Control Solutions: - Use tools like Microsoft Defende…
MITRE mitigation sourceRemote Access Hardware
An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).(Citation: Palo Alto Unit 42 North Korean IT Workers 2024)(Citation: Google Cloud Threat Intelligence DPRK IT Workers 2024)
Open in the interactive knowledge mesh
Detection overview
Use the published detection strategies below and validate required telemetry in the target environment.
Observed groups
No current Enterprise group relationship is published in this bundle.
Cyber Knowledge context
Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.
Cyber Threat Intelligence (CTI) · topic-match · 60/100Module 10 — Career Path Continuing Education
Cyber Threat Intelligence (CTI) · topic-match · 48/100Module 6 — The Threat Actor Landscape
Cyber Threat Intelligence (CTI) · tactic-route · 24/100Disassembly, decompilation, and code-led analysis
Malware Analysis & Reverse Engineering · tactic-route · 24/100Module 5 — Threat hunting
Blue Team & Defensive Security · tactic-route · 24/100
MITRE mitigations
MITRE detection strategies and analytics
- AN0446 · Analytic 0446 — Detection of USB-based remote access hardware (e.g., TinyPilot, PiKVM) attached to the host via drive or peripheral enumeration, triggering vendor identifiers or unusual EDID announcements.
- AN0447 · Analytic 0447 — Insertion of USB-based hardware proxies (e.g., PiKVM) which register under predictable names (e.g., tinypilot) or mount under known paths (e.g., /opt/tinypilot-privileged).
- AN0448 · Analytic 0448 — Attachment of hardware-backed USB KVM devices (e.g., TinyPilot) that enumerate new HID or serial communication interfaces with identifiable metadata.