IP-KVM Hardware Hiding Behind Spoofed USB Descriptors

Any row names a host whose USB or audio-endpoint artifacts survive a renamed IP-KVM; read the Evidence column for the matched value.

// Hunt: IP-KVM with renamed USB strings. Default serials survive a rename; so does the audio-endpoint
// rename TinyPilot documents (Toshiba-H2C).
union
// optional: one hardware id enrolling under 3 or more setup classes, which approximates a composite KVM; webcams, headsets and docks match too
( DeviceEvents
  | where Timestamp > ago(90d) and ActionType == "PnpDeviceConnected"
  | extend Fields = parse_json(AdditionalFields)
  | extend HardwareId = extract(@"(VID_[0-9A-Fa-f]{4}&PID_[0-9A-Fa-f]{4})", 1, tostring(Fields.DeviceId))
  | where isnotempty(HardwareId)
  | summarize Timestamp = max(Timestamp), Classes = make_set(tostring(Fields.ClassName)) by DeviceName, HardwareId
  | where array_length(Classes) >= 3
  | project Timestamp, DeviceName, Signal = "three-setup-classes", Evidence = strcat(HardwareId, " ", tostring(Classes)) ),
( DeviceEvents
  | where Timestamp > ago(90d) and ActionType == "PnpDeviceConnected"
  | extend Raw = tostring(AdditionalFields)
  | where Raw has_any ("cafebabe", "6b65796d696d657069")
      // optional: generic Linux USB gadget id, shared by any board emulating peripherals
      or Raw contains "VID_1D6B&PID_0104"
  | project Timestamp, DeviceName, Signal = "default-serial-or-gadget-id", Evidence = Raw ),
( DeviceRegistryEvents
  | where Timestamp > ago(90d) and ActionType in ("RegistryValueSet", "RegistryKeyCreated")
  | where RegistryKey contains @"CurrentVersion\MMDevices\Audio"
  | where RegistryValueData contains "Toshiba-H2C" or RegistryValueData has_any ("tinypilot", "pikvm", "6b65796d696d657069")
  | project Timestamp, DeviceName, Signal = "audio-endpoint-rename", Evidence = strcat(RegistryValueName, " = ", RegistryValueData) )
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Signals = make_set(Signal), Evidence = make_set(Evidence, 10) by DeviceName
| sort by LastSeen desc

Matches the audio-endpoint rename TinyPilot documents, using the registry_set category so it runs on any Sysmon- or EDR-fed backend.

title: USB Audio Endpoint Renamed to Hide an IP-KVM
id: 4c0b53a6-7e0d-4f3e-9a5b-1d2f6a8e3c71
status: experimental
description: >
  Detects a write under the Windows MMDevices audio endpoint keys that names the
  endpoint after TinyPilot, PiKVM or the string TinyPilot's own documentation
  tells Windows users to enter in mmsys.cpl (Toshiba-H2C), or that carries the
  fixed TinyPilot USB serial in the endpoint's device path. The rename hides the
  product name; the serial and the suggested string remain.
references:
  - https://docs.tinypilotkvm.com/article/22-can-anyone-detect-when-im-using-tinypilot
  - https://blog.grumpygoose.io/unemployfuscation-1a1721485312
logsource:
  category: registry_set
detection:
  selection_key:
    TargetObject|contains: 'CurrentVersion\MMDevices\Audio'
  selection_value:
    Details|contains:
      - 'Toshiba-H2C'
      - 'TinyPilot'
      - 'PiKVM'
      - '6b65796d696d657069'
  condition: selection_key and selection_value
falsepositives:
  - A person who legitimately names an audio endpoint after a TinyPilot or PiKVM they own
level: high

signals shows which of the audio-endpoint rename, default serial or gadget id fired for each host.

```Placeholders: index=edr is your EDR registry and process events; index=wineventlog is WinEventLog:Security (event 6416).```
((index=edr "MMDevices" ("Toshiba-H2C" OR "TinyPilot" OR "PiKVM" OR "6b65796d696d657069"))
    OR (index=wineventlog EventCode=6416 ("CAFEBABE" OR "6b65796d696d657069"))
    ```optional: generic Linux USB gadget id, shared by any board emulating peripherals```
    OR (index=wineventlog EventCode=6416 "VID_1D6B&PID_0104")
    )
| eval signal=case(index="edr", "audio-endpoint-rename", match(_raw, "(?i)cafebabe|6b65796d696d657069"), "default-serial", true(), "gadget-id")
| stats min(_time) AS first_seen max(_time) AS last_seen values(signal) AS signals BY host
| sort - last_seen
| convert ctime(first_seen) ctime(last_seen)

The configuration name survives a stock rename of the vendor, product and serial strings, so a config-name hit is the strongest result here.

// Hunt: IP-KVM with renamed USB strings. Field names are those of the Grumpy Goose Labs Falcon query.
(#event_simpleName=DcUsbConfigurationDescriptor or #event_simpleName=DcUsbDeviceConnected)
| case {
    #event_simpleName=DcUsbConfigurationDescriptor ConfigurationDescriptorName=/Config [0-9]: (PiKVM|ECM) device/i | signal := "config-name";
    #event_simpleName=DcUsbDeviceConnected DeviceSerialNumber=/cafebabe|6b65796d696d657069/i | signal := "default-serial";
    // optional: five interfaces that the claimed identity does not account for; headsets and docks can reach it
    #event_simpleName=DcUsbConfigurationDescriptor ConfigurationDescriptorNumInterfaces >= 5 | signal := "five-interfaces";
    * | signal := "";
  }
| signal != ""
| groupBy([aid, ComputerName, DeviceDescriptorSetHash], function=[collect([signal, ConfigurationDescriptorName, DeviceManufacturer, DeviceProduct, DeviceSerialNumber]), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])
| sort(lastSeen, order=desc)

Reads Elastic Defend registry events and the Windows 6416 event; signals names the artifact that fired.

FROM logs-endpoint.events.registry-*, logs-system.security-*, winlogbeat-*
| WHERE @timestamp > NOW() - 90 days
| EVAL reg = TO_LOWER(CONCAT(COALESCE(registry.path, ""), " ", COALESCE(MV_CONCAT(registry.data.strings, " "), "")))
| EVAL usb = TO_LOWER(COALESCE(winlog.event_data.DeviceId, ""))
| EVAL signal = CASE(
    reg RLIKE ".*mmdevices.audio.*(toshiba-h2c|tinypilot|pikvm|6b65796d696d657069).*", "audio-endpoint-rename",
    event.code == "6416" AND usb RLIKE ".*(cafebabe|6b65796d696d657069).*", "default-serial",
    "")
| EVAL signal = CASE(signal != "", signal, event.code == "6416" AND usb RLIKE ".*vid_1d6b&pid_0104.*", "gadget-id", "")
| WHERE signal != ""
| STATS first_seen = MIN(@timestamp), last_seen = MAX(@timestamp), signals = VALUES(signal) BY host.name
| SORT last_seen DESC

Finds the audio-endpoint rename in xdr_data registry events; USB descriptor and serial checks need the Device Control data.

// Hunt: IP-KVM with renamed USB strings. xdr_data carries the audio-endpoint rename; USB descriptors are not in it.
dataset = xdr_data
| filter event_type = ENUM.REGISTRY and action_registry_key_name ~= "(?i)CurrentVersion.MMDevices.Audio"
    and action_registry_data ~= "(?i)toshiba-h2c|tinypilot|pikvm|6b65796d696d657069"
| comp min(_time) as first_seen, max(_time) as last_seen, values(action_registry_data) as values_set by agent_hostname
| sort desc last_seen

Local check on macOS and Linux for a device that kept its default serial after its name strings were changed.

-- Hunt: IP-KVM with renamed USB strings. The default serial survives a rename of the name strings.
-- usb_devices exists on macOS and Linux only; Windows hosts are covered by the registry and event queries.
SELECT serial, vendor_id, model_id, vendor, model
FROM usb_devices
WHERE serial IN ('CAFEBABE', '6b65796d696d657069')
   OR (vendor_id = '1d6b' AND model_id = '0104')  -- optional: generic Linux gadget id, shared by any board emulating peripherals