IP-KVM Hardware on a Corporate Laptop and on Its Network Segment

A host listing both Classes (IP-KVM and CaptureCard) is the pairing Huntress reports; confirm the AdditionalFields keys against a known PnpDeviceConnected event in your tenant.

// Hunt: IP-KVM and capture-card hardware on a corporate laptop. Windows PnP,
// macOS colour profiles, and any command line or lookup naming tinypilot.
let KvmWords = dynamic(["pikvm", "tinypilot", "glkvm", "cafebabe", "6b65796d696d657069"]);
let CaptureWords = dynamic(["guermok", "ultrasemi", "macrosilicon"]);
union
( DeviceEvents
  | where Timestamp > ago(90d) and ActionType == "PnpDeviceConnected"
  | extend Raw = tostring(AdditionalFields)
  | extend Class = case(
      Raw has_any (KvmWords)
        // optional: generic Linux USB gadget id, shared by any board emulating peripherals
        or Raw contains "VID_1D6B&PID_0104"
        // optional: GL.iNet also sells routers and travel hubs
        or Raw has "glinet"
        or Raw contains "VID_3346&PID_1009", "IP-KVM",
      // optional: capture cards are common alone; they only matter next to an IP-KVM
      Raw has_any (CaptureWords) or Raw contains "VID_345F&PID_2130", "CaptureCard",
      "")
  | where Class != ""
  | project Timestamp, DeviceName, Class, Signal = "usb-enrolment", Evidence = Raw ),
( DeviceFileEvents
  | where Timestamp > ago(90d) and ActionType in ("FileCreated", "FileModified", "FileRenamed")
  | where FolderPath contains "/ColorSync/Profiles/Displays"
  | where FileName has_any ("tinypilot", "pikvm", "glkvm")
  | project Timestamp, DeviceName, Class = "IP-KVM", Signal = "colorsync-profile", Evidence = FileName ),
( DeviceNetworkEvents
  | where Timestamp > ago(90d) and RemoteUrl has "tinypilot"
  | project Timestamp, DeviceName, Class = "IP-KVM", Signal = "tinypilot-lookup", Evidence = RemoteUrl ),
( DeviceProcessEvents
  | where Timestamp > ago(90d) and ProcessCommandLine has "tinypilot"
  | project Timestamp, DeviceName, Class = "IP-KVM", Signal = "tinypilot-command", Evidence = ProcessCommandLine )
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Classes = make_set(Class),
            Signals = make_set(Signal), Evidence = make_set(Evidence, 10) by DeviceName
| extend KvmAndCapture = set_has_element(Classes, "IP-KVM") and set_has_element(Classes, "CaptureCard")
| sort by KvmAndCapture desc, LastSeen desc

Matches the Windows Security 6416 enrolment event; it is the only rule here that keeps product: windows, because 6416 does not exist elsewhere.

title: IP-KVM or USB Capture-Card Hardware Recognized by a Corporate Endpoint
id: a60aaf7f-d5ee-592e-aa29-85af6afa4359
status: experimental
description: >
  Detects Windows recognizing an external device whose descriptor, hardware id
  or serial matches the KVM-over-IP and video-capture hardware reported in DPRK
  IT-worker laptop-farm cases (PiKVM, TinyPilot, NanoKVM, GL.iNet Comet,
  Guermok USB3 Video and the chipset names it enumerates under). Hardware of
  this class gives an operator console control of the host without any
  software an EDR agent inspects, so the enrolment event is often the only
  endpoint-side signal.
references:
  - https://www.huntress.com/blog/huntress-dprk-remote-worker-investigation
  - https://reliaquest.com/blog/threat-spotlight-identifying-north-korean-insider-threats
logsource:
  product: windows
  service: security
detection:
  selection_event:
    EventID: 6416
  selection_description:
    DeviceDescription|contains:
      - 'PiKVM'
      - 'TinyPilot'
      - 'GLKVM'
      - 'Guermok'
      - 'UltraSemi'
      - 'MacroSilicon'
      # optional: GL.iNet also sells routers and travel hubs
      - 'Glinet'
  selection_id:
    DeviceId|contains:
      - 'VID_345F&PID_2130'
      - 'VID_3346&PID_1009'
      - 'CAFEBABE'
      - '6b65796d696d657069'
      # optional: generic Linux USB gadget id, shared by any board emulating peripherals
      - 'VID_1D6B&PID_0104'
  condition: selection_event and (selection_description or selection_id)
falsepositives:
  - Out-of-band management hardware legitimately deployed in a lab, test bench or datacenter
  - VID_1D6B&PID_0104 is the generic Linux USB gadget identifier and is not unique to KVM hardware
level: high

Free-text matching over the raw events means it works without field extractions; kvm_and_capture=yes marks the pairing Huntress reports.

```Placeholders: index=wineventlog is WinEventLog:Security (event 6416); index=edr is your EDR process, file and DNS events (macOS and Windows); index=dhcp is DHCP leases.```
((index=wineventlog EventCode=6416) OR index=edr)
    ("PiKVM" OR "TinyPilot" OR "GLKVM" OR "CAFEBABE" OR "6b65796d696d657069" OR "VID_3346&PID_1009"
     ```optional: generic Linux USB gadget id, shared by any board emulating peripherals``` OR "VID_1D6B&PID_0104"
     ```optional: GL.iNet also sells routers and travel hubs``` OR "Glinet"
     ```optional: capture cards are common alone; they only matter next to an IP-KVM``` OR "Guermok" OR "UltraSemi" OR "MacroSilicon" OR "VID_345F&PID_2130")
| eval kvm=if(match(_raw, "(?i)pikvm|tinypilot|glkvm|cafebabe|6b65796d696d657069|vid_3346&pid_1009"), 1, 0)
```optional: generic Linux USB gadget id```
| eval kvm=if(match(_raw, "(?i)vid_1d6b&pid_0104"), 1, kvm)
```optional: GL.iNet```
| eval kvm=if(match(_raw, "(?i)glinet"), 1, kvm)
```optional: capture cards```
| eval capture=if(match(_raw, "(?i)guermok|ultrasemi|macrosilicon|vid_345f&pid_2130"), 1, 0)
| stats min(_time) AS first_seen max(_time) AS last_seen max(kvm) AS kvm max(capture) AS capture
        values(sourcetype) AS sources BY host
| eval kvm_and_capture=if(kvm=1 AND capture=1, "yes", "no")
```optional: Raspberry Pi and TinyPilot MAC prefixes in DHCP; every Pi on a home network matches. Delete from here to the closing bracket to drop it.```
| append
    [ search index=dhcp
      | eval mac_clean=lower(replace(mac, "[:.-]", ""))
      | eval oui=substr(mac_clean, 1, 6)
      | search oui IN ("04c98b", "b827eb", "28cdc1", "d83add", "dca632", "e45f01", "2ccf67", "3a3541", "88a29e", "98fe54")
      | stats min(_time) AS first_seen max(_time) AS last_seen values(ip) AS addresses
              values(hostname) AS hostnames BY mac_clean ]
| sort - kvm_and_capture - last_seen
| convert ctime(first_seen) ctime(last_seen)

Event-wide regex branches avoid assuming DcUsbDeviceConnected field names, which Falcon documents only inside the console; the command-line and DNS branches use standard fields.

// Hunt: IP-KVM and capture-card hardware. Device Control USB events, plus any command line or lookup naming tinypilot.
// The USB branches match the whole event, so no DcUsbDeviceConnected field name is assumed.
(#event_simpleName=DcUsbDeviceConnected or #event_simpleName=ProcessRollup2 or #event_simpleName=SyntheticProcessRollup2 or #event_simpleName=DnsRequest)
| case {
    #event_simpleName=DcUsbDeviceConnected /pikvm|tinypilot|glkvm|cafebabe|6b65796d696d657069|vid_3346&pid_1009/i | class := "IP-KVM";
    // optional: generic Linux USB gadget id, shared by any board emulating peripherals
    #event_simpleName=DcUsbDeviceConnected /vid_1d6b&pid_0104/i | class := "IP-KVM";
    // optional: GL.iNet also sells routers and travel hubs
    #event_simpleName=DcUsbDeviceConnected /glinet/i | class := "IP-KVM";
    // optional: capture cards are common alone; they only matter next to an IP-KVM
    #event_simpleName=DcUsbDeviceConnected /guermok|ultrasemi|macrosilicon|vid_345f&pid_2130/i | class := "CaptureCard";
    CommandLine=/tinypilot/i | class := "IP-KVM";
    DomainName=/tinypilot/i | class := "IP-KVM";
    * | class := "";
  }
| class != ""
| groupBy([aid, ComputerName], function=[min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen), collect([class]), count(class, distinct=true, as=classes)])
| sort(lastSeen, order=desc)

Reads the Windows 6416 event plus Elastic Defend file, process and network events; classes = 2 marks the IP-KVM and capture-card pairing.

FROM logs-system.security-*, winlogbeat-*, logs-endpoint.events.file-*, logs-endpoint.events.process-*, logs-endpoint.events.network-*
| WHERE @timestamp > NOW() - 90 days
| EVAL usb = TO_LOWER(CONCAT(COALESCE(winlog.event_data.DeviceDescription, ""), " ", COALESCE(winlog.event_data.DeviceId, "")))
| EVAL other = TO_LOWER(CONCAT(COALESCE(file.path, ""), " ", COALESCE(process.command_line, ""), " ", COALESCE(dns.question.name, "")))
| EVAL class = CASE(
    event.code == "6416" AND usb RLIKE ".*(pikvm|tinypilot|glkvm|cafebabe|6b65796d696d657069|vid_3346&pid_1009).*", "IP-KVM",
    event.code == "6416" AND usb RLIKE ".*(guermok|ultrasemi|macrosilicon|vid_345f&pid_2130).*", "CaptureCard",
    other RLIKE ".*(/colorsync/profiles/displays/.*(tinypilot|pikvm|glkvm)|tinypilot).*", "IP-KVM",
    "")
| EVAL class = CASE(class != "", class, event.code == "6416" AND usb RLIKE ".*vid_1d6b&pid_0104.*", "IP-KVM", "")
| EVAL class = CASE(class != "", class, event.code == "6416" AND usb RLIKE ".*glinet.*", "IP-KVM", "")
| WHERE class != ""
| STATS first_seen = MIN(@timestamp), last_seen = MAX(@timestamp), classes = COUNT_DISTINCT(class) BY host.name
| SORT classes DESC, last_seen DESC

Covers the three matches xdr_data records on both operating systems; USB enrolment needs the Windows event or osquery queries.

// Hunt: IP-KVM hardware. xdr_data carries the colour-profile, command-line and DNS matches; USB enrolment is not in it.
dataset = xdr_data
| filter (event_type = ENUM.FILE and action_file_path ~= "(?i)/ColorSync/Profiles/Displays/" and action_file_name ~= "(?i)tinypilot|pikvm|glkvm")
    or (event_type = ENUM.PROCESS and action_process_image_command_line ~= "(?i)tinypilot")
    or (event_type = ENUM.NETWORK and (dns_query_name ~= "(?i)tinypilot" or action_external_hostname ~= "(?i)tinypilot"))
| alter signal = if(event_type = ENUM.FILE, "colorsync-profile", if(event_type = ENUM.PROCESS, "tinypilot-command", "tinypilot-lookup"))
| comp min(_time) as first_seen, max(_time) as last_seen, values(signal) as signals by agent_hostname
| sort desc last_seen

Local state check for macOS and Linux endpoints: attached USB devices, ColorSync profiles that persist after a KVM is unplugged, and neighbours with Raspberry Pi prefixes.

-- Hunt: IP-KVM hardware on macOS (Linux for the USB and ARP branches); osquery has no usb_devices table on Windows.
SELECT 'usb-device' AS signal, vendor || ' ' || model || ' ' || serial || ' ' || vendor_id || ':' || model_id AS evidence
FROM usb_devices
WHERE vendor || model LIKE '%PiKVM%'
   OR vendor || model LIKE '%TinyPilot%'
   OR vendor || model LIKE '%GLKVM%'
   OR (vendor_id = '3346' AND model_id = '1009')
   OR serial IN ('CAFEBABE', '6b65796d696d657069')
   OR (vendor_id = '1d6b' AND model_id = '0104')  -- optional: generic Linux gadget id, shared by any board emulating peripherals
   OR vendor LIKE '%Glinet%'  -- optional: GL.iNet also sells routers and travel hubs
   OR (vendor_id = '345f' AND model_id = '2130') OR vendor || model LIKE '%Guermok%' OR vendor || model LIKE '%UltraSemi%' OR vendor || model LIKE '%MacroSilicon%'  -- optional: capture cards are common alone
UNION ALL
SELECT 'colorsync-profile', path || ' (created ' || btime || ')'
FROM file
WHERE (path LIKE '/Library/ColorSync/Profiles/Displays/%' OR path LIKE '/Users/%/Library/ColorSync/Profiles/Displays/%')
  AND (filename LIKE '%TinyPilot%' OR filename LIKE '%PiKVM%' OR filename LIKE '%GLKVM%')
UNION ALL
-- optional: Raspberry Pi and TinyPilot MAC prefixes in the ARP cache; every Pi on the segment matches
-- (macOS prints octets without the leading zero, so 04:c9:8b and e4:5f:01 each appear twice)
SELECT 'arp-neighbour', address || ' ' || mac
FROM arp_cache
WHERE mac LIKE '04:c9:8b:%' OR mac LIKE '4:c9:8b:%' OR mac LIKE 'b8:27:eb:%' OR mac LIKE '28:cd:c1:%'
   OR mac LIKE 'd8:3a:dd:%' OR mac LIKE 'dc:a6:32:%' OR mac LIKE 'e4:5f:01:%' OR mac LIKE 'e4:5f:1:%'
   OR mac LIKE '2c:cf:67:%' OR mac LIKE '3a:35:41:%' OR mac LIKE '88:a2:9e:%' OR mac LIKE '98:fe:54:%';

Internet-exposed KVM web interfaces; cross-reference the exported addresses against sign-in and VPN source addresses to find a workstation connecting from one.

http.title:tinypilot,pikvm
http.title:"PiKVM"
http.title:"TinyPilot"
http.html:'<script src="guacamole'