GL.iNet Comet IP-KVM Behind Its Built-In Obfuscation Profiles

Defender does not surface the USB configuration descriptor, so this finds the stock strings and the serial-plus-VID/PID pair; the descriptor name needs Falcon.

// Hunt: GL.iNet Comet, stock or running an obfuscation profile (the serial and VID/PID pair survive the profiles).
let SpoofIds = dynamic(["VID_1D6B&PID_0104", "VID_046D&PID_C526", "VID_6940&PID_6973", "VID_413C&PID_2011", "VID_045E&PID_005F"]);
union
( DeviceEvents
  | where Timestamp > ago(90d) and ActionType == "PnpDeviceConnected"
  | extend Raw = tostring(AdditionalFields)
  | where Raw has_any ("GLKVM", "Glinet", "GLIKVM", "GLIC21C") or Raw contains "Composite KVM Device"
      or (Raw has "CAFEBABE" and Raw has_any (SpoofIds))
  | project Timestamp, DeviceName, Signal = "usb-or-display-enrolment", Evidence = Raw ),
( DeviceNetworkEvents
  | where Timestamp > ago(90d) and RemoteUrl has "glkvm"
  | project Timestamp, DeviceName, Signal = "glkvm-lookup", Evidence = RemoteUrl )
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Signals = make_set(Signal), Evidence = make_set(Evidence, 10) by DeviceName
| sort by LastSeen desc

Matches the Windows Security 6416 enrolment event for the stock strings or for the serial with a gadget or spoofed identity.

title: GL.iNet Comet IP-KVM Recognized by a Corporate Endpoint
id: 35f97668-42dc-5aa5-a0ff-3f0d60a06792
status: experimental
description: >
  Detects Windows recognizing a GL.iNet Comet IP-KVM, by the stock vendor and
  product strings or by the default serial CAFEBABE paired with the generic
  gadget id or one of the four peripheral identities the firmware's built-in
  obfuscation profiles present. Hardware of this class hands an operator
  console control of the host below the operating system, so the enrolment
  event is often the only endpoint-side signal.
references:
  - https://blog.grumpygoose.io/be-kvm-do-fraud-8ab523d26c9d
  - https://docs.gl-inet.com/kvm/en/faq/local_access_via_browser/
logsource:
  product: windows
  service: security
detection:
  selection_event:
    EventID: 6416
  selection_description:
    DeviceDescription|contains:
      - 'GLKVM'
      - 'Glinet'
      - 'GLIKVM'
      - 'Composite KVM Device'
  selection_serial:
    DeviceId|contains: 'CAFEBABE'
  selection_ids:
    DeviceId|contains:
      - 'VID_1D6B&PID_0104'
      - 'VID_046D&PID_C526'
      - 'VID_6940&PID_6973'
      - 'VID_413C&PID_2011'
      - 'VID_045E&PID_005F'
  condition: selection_event and (selection_description or (selection_serial and selection_ids))
falsepositives:
  - Out-of-band management hardware legitimately deployed in a lab, test bench or datacenter
  - Composite KVM Device is also the product string a stock PiKVM reports, so it identifies the class of device
level: high

Free-text matching over raw events, so it works without field extractions on the Windows event and EDR data.

```Placeholders: index=wineventlog is WinEventLog:Security (event 6416); index=edr is your EDR USB, process, DNS and connection events; index=dhcp is DHCP leases.```
((index=wineventlog EventCode=6416) OR index=edr)
    ("GLKVM" OR "Glinet" OR "GLIKVM" OR "GLIC21C" OR "Composite KVM Device"
     OR ("CAFEBABE" AND ("VID_1D6B&PID_0104" OR "VID_046D&PID_C526" OR "VID_6940&PID_6973" OR "VID_413C&PID_2011" OR "VID_045E&PID_005F")))
| stats min(_time) AS first_seen max(_time) AS last_seen values(sourcetype) AS sources BY host
```optional: GL.iNet, JetKVM and NanoKVM MAC prefixes in DHCP; GL.iNet's main business is travel routers, so 94:83:C4 matches those too. Delete from here to the closing bracket to drop it.```
| append
    [ search index=dhcp
      | eval mac_clean=lower(replace(mac, "[:.-]", ""))
      | eval oui=substr(mac_clean, 1, 6)
      | search oui IN ("9483c4", "803428", "48da35") OR hostname="*glkvm*"
      | stats min(_time) AS first_seen max(_time) AS last_seen values(ip) AS addresses
              values(hostname) AS hostnames BY mac_clean ]
| sort - last_seen
| convert ctime(first_seen) ctime(last_seen)

The configuration name survives every built-in obfuscation profile, so a config-name hit is the anchor result.

// Hunt: GL.iNet Comet. Field names follow the Grumpy Goose Labs Falcon queries.
(#event_simpleName=DcUsbConfigurationDescriptor or #event_simpleName=DcUsbDeviceConnected or #event_simpleName=DnsRequest or #event_simpleName=NeighborListIP4)
| case {
    #event_simpleName=DcUsbConfigurationDescriptor ConfigurationDescriptorName=/(GLKVM|Glinet) device/i | signal := "config-name";
    #event_simpleName=DcUsbDeviceConnected DeviceManufacturer=/GLKVM|GLIKVM|Glinet/i | signal := "stock-manufacturer";
    #event_simpleName=DcUsbDeviceConnected DeviceProduct=/Composite KVM Device/i | signal := "stock-product";
    #event_simpleName=DcUsbDeviceConnected DeviceSerialNumber=/CAFEBABE/i | signal := "default-serial";
    #event_simpleName=DnsRequest DomainName=/glkvm/i | signal := "glkvm-lookup";
    // optional: seven interfaces at 125 mA is the profile shape; composite docks can also reach seven
    #event_simpleName=DcUsbConfigurationDescriptor ConfigurationDescriptorNumInterfaces = 7 ConfigurationDescriptorMaxPowerDraw = 125 | signal := "seven-interfaces-125mA";
    // optional: GL.iNet, JetKVM and NanoKVM MAC prefixes in the ARP neighbour list; travel routers match 94-83-c4
    #event_simpleName=NeighborListIP4 /(94-83-c4|80-34-28|48-da-35)/i | signal := "kvm-mac-prefix";
    * | signal := "";
  }
| signal != ""
| groupBy([aid, ComputerName], function=[collect([signal, ConfigurationDescriptorName, DeviceManufacturer, DeviceProduct, DeviceSerialNumber]), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])
| sort(lastSeen, order=desc)

Reads the Windows 6416 event and Elastic Defend DNS events; signals names the artifact that fired.

FROM logs-system.security-*, winlogbeat-*, logs-endpoint.events.network-*
| WHERE @timestamp > NOW() - 90 days
| EVAL usb = TO_LOWER(CONCAT(COALESCE(winlog.event_data.DeviceDescription, ""), " ", COALESCE(winlog.event_data.DeviceId, "")))
| EVAL signal = CASE(
    event.code == "6416" AND usb RLIKE ".*(glkvm|glinet|glikvm|composite kvm device).*", "stock-strings",
    event.code == "6416" AND usb RLIKE ".*cafebabe.*" AND usb RLIKE ".*(vid_1d6b&pid_0104|vid_046d&pid_c526|vid_6940&pid_6973|vid_413c&pid_2011|vid_045e&pid_005f).*", "serial-and-spoofed-id",
    TO_LOWER(COALESCE(dns.question.name, "")) RLIKE ".*glkvm.*", "glkvm-lookup",
    "")
| WHERE signal != ""
| STATS first_seen = MIN(@timestamp), last_seen = MAX(@timestamp), signals = VALUES(signal) BY host.name
| SORT last_seen DESC

Finds hosts that looked up a glkvm name; USB descriptor checks need the Windows event or osquery queries.

// Hunt: GL.iNet Comet. xdr_data carries the glkvm lookup; USB descriptors are not in it.
dataset = xdr_data
| filter event_type = ENUM.NETWORK and (dns_query_name ~= "(?i)glkvm" or action_external_hostname ~= "(?i)glkvm")
| comp min(_time) as first_seen, max(_time) as last_seen, values(dns_query_name) as lookups by agent_hostname
| sort desc last_seen

Local check on macOS and Linux for the stock strings, the serial with a spoofed identity, and ARP neighbours with KVM-vendor prefixes.

-- Hunt: GL.iNet Comet on macOS and Linux (usb_devices does not exist on Windows).
SELECT 'usb-device' AS signal, vendor || ' ' || model || ' ' || serial || ' ' || vendor_id || ':' || model_id AS evidence
FROM usb_devices
WHERE vendor LIKE '%GLKVM%' OR vendor LIKE '%GLIKVM%' OR vendor LIKE '%Glinet%' OR model LIKE '%Composite KVM Device%'
   OR (serial = 'CAFEBABE' AND ((vendor_id = '1d6b' AND model_id = '0104') OR (vendor_id = '046d' AND model_id = 'c526')
       OR (vendor_id = '6940' AND model_id = '6973') OR (vendor_id = '413c' AND model_id = '2011')
       OR (vendor_id = '045e' AND model_id = '005f')))
UNION ALL
-- optional: GL.iNet, JetKVM and NanoKVM MAC prefixes in the ARP cache; travel routers match 94:83:c4
SELECT 'arp-neighbour', address || ' ' || mac
FROM arp_cache
WHERE mac LIKE '94:83:c4:%' OR mac LIKE '80:34:28:%' OR mac LIKE '48:da:35:%'