A subject deploys a hardware-based remote access device, typically an IP-KVM (Keyboard, Video, Mouse over IP) system, to remotely interact with a workstation or server through its physical interfaces. These devices connect directly to the system’s video output (HDMI or DisplayPort) and USB ports, capturing the display signal while injecting keyboard and mouse input remotely. The device presents itself to the operating system as standard USB Human Interface Devices (HID), such as a generic keyboard and mouse, allowing the subject to interact with the system as though physically present at the console. Because the interaction occurs through physical interface emulation rather than installed software, activity generated through the device appears as local console input to the operating system. This can bypass controls designed to detect or restrict software-based remote access tools such as Remote Desktop Protocol (RDP) or third-party remote administration platforms. Many IP-KVM devices provide independent network connectivity, including Ethernet, Wi-Fi, or cellular access, allowing the subject to maintain remote interaction with the system through an external management interface. When used in this manner, the remote session may not traverse corporate remote access infrastructure or generate conventional remote access/network logs. While these devices have legitimate uses in system administration, hardware labs, and data center environments, a subject may deploy them covertly to maintain persistent remote access to a system without installing software or triggering typical remote access monitoring or network controls. Within the Insider Threat Matrix, this behavior represents preparatory activity, as it establishes a covert remote control capability that may later enable unauthorized access, data exfiltration, or system manipulation.

Implement strict allow-listing controls for USB Human Interface Devices (HID) such as keyboards and mice on corporate endpoints. Hardware-based remote access devices, including IP-KVM platforms, commonly emulate generic USB HID peripherals in order to inject keyboard and mouse input into a host system. When connected, these devices are typically recognized by the operating system as standard keyboards or mice, allowing them to interact with the system without requiring specialized drivers or software. Many IP-KVM platforms intentionally present themselves as generic HID devices to maximize compatibility across operating systems. By enforcing allow-listing policies that restrict which HID peripherals are permitted to connect to corporate endpoints, organizations can significantly reduce the risk of unauthorized hardware devices being used to inject input or maintain covert remote interaction with a system.Prevention MeasuresImplement device control policies within endpoint protection platforms capable of enforcing USB peripheral restrictions. These controls should block newly connected HID devices unless they match an approved allow-list.Define allow-list rules based on hardware identifiers, including vendor ID (VID), product ID (PID), device serial numbers, or cryptographic device fingerprints where supported.Configure endpoint security platforms or operating system controls to deny interaction from unapproved HID devices, preventing unauthorized keyboards or mice from delivering input to the system.Maintain an inventory of approved keyboard and mouse models used within the organization and map their hardware identifiers into the allow-list policy.Apply stricter HID allow-listing policies on high-risk systems, including administrative workstations, developer environments, and systems that handle sensitive or regulated data.Monitor device control logs for blocked peripheral connection attempts, as repeated attempts to attach unauthorized HID devices may indicate attempts to deploy hardware capable of injecting input or maintaining covert remote interaction with an endpoint.

Restrict physical access to USB and display ports on corporate workstations to prevent unauthorized hardware from being connected to the system. Hardware-based remote access devices such as IP-KVM platforms require direct connection to the endpoint’s USB ports and video outputs in order to capture display output and inject keyboard or mouse input. If these physical interfaces are accessible, a subject may attach hardware capable of maintaining covert remote interaction with the system. Implementing physical controls that limit access to these interfaces can significantly reduce the risk of unauthorized hardware devices being deployed on corporate endpoints. Prevention MeasuresDisable unused USB ports through BIOS/UEFI configuration or endpoint management policies where operationally feasible.Use physical USB port blockers or locking port covers on systems deployed in shared offices, open workspaces, or other environments where unauthorized access to workstation ports is possible.Secure display interfaces such as HDMI or DisplayPort connections using cable management or port protection mechanisms to prevent insertion of intermediary capture devices.Establish workstation hardware inspection procedures during IT support visits, security audits, or equipment refresh cycles to identify unauthorized devices connected between system components.Maintain workstation configurations where peripheral cabling is visible and auditable, making it easier for support staff or security personnel to detect unfamiliar hardware devices attached to endpoints.Apply enhanced physical security measures to high-risk systems, including administrative workstations, developer environments, and systems that access sensitive or regulated data.