- Tactics
- Command and Control
- Platforms
- Linux, macOS, Windows
- Reference
- attack.mitre.org/techniques/T1219.003
Description
An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment.
Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).(Citation: Palo Alto Unit 42 North Korean IT Workers 2024)(Citation: Google Cloud Threat Intelligence DPRK IT Workers 2024)
How GTK Cyber trains on this
GTK Cyber's Threat Hunting with Data Science course teaches you to build machine-learning detections for techniques like this across the MITRE ATT&CK framework, including the Command and Control tactic this technique falls under. Practitioner-led, focused on real detections, not memorizing technique IDs.
Related techniques
- T1001 - Data Obfuscation
- T1008 - Fallback Channels
- T1071 - Application Layer Protocol
- T1090 - Proxy
- T1092 - Communication Through Removable Media
- T1095 - Non-Application Layer Protocol
- T1102 - Web Service
- T1104 - Multi-Stage Channels
- T1105 - Ingress Tool Transfer
- T1132 - Data Encoding
- T1205 - Traffic Signaling
- T1219 - Remote Access Tools