AN0446
Analytic 0446
Windows
Detection of USB-based remote access hardware (e.g., TinyPilot, PiKVM) attached to the host via drive or peripheral enumeration, triggering vendor identifiers or unusual EDID announcements.
WinEventLog:System
EventCode=2003
[VendorID]
Device vendor strings may need tuning to include additional remote hardware sources.
[SerialNumber]
Serial numbers for known implants can vary per campaign and may need expansion.
[TimeWindow]
Adjust the detection window for peripheral enumeration based on environment and operating hours.
AN0447
Analytic 0447
Linux
Insertion of USB-based hardware proxies (e.g., PiKVM) which register under predictable names (e.g., tinypilot) or mount under known paths (e.g., /opt/tinypilot-privileged).
auditd:SYSCALL
udev events or drive enumeration involving TinyPilot paths or device classes
[FriendlyName]
Different hardware may present differently; names like 'TinyPilot' may need expanding to cover custom implants.
[MountPath]
Path matching (e.g., /opt/tinypilot) is mutable based on distro, customization, and staging.
AN0448
Analytic 0448
macOS
Attachment of hardware-backed USB KVM devices (e.g., TinyPilot) that enumerate new HID or serial communication interfaces with identifiable metadata.
macos:unifiedlog
Hardware enumeration events via IOKit or USBMuxd showing TinyPilot or unknown keyboard/mouse
[DeviceClass]
Input or HID devices may be benign or malicious depending on context; tune based on environment (e.g., BYOD/dev stations).
[SerialCorrelationDepth]
Correlating serials across multiple device insertions may reduce noise but requires tuning.