DPRK IT Worker PiKVM Remote KVM Device Driver Installation Cluster
This rule detects the frequent installation of KVM-related hardware devices (e.g., PiKVM, USB video/HID devices) on a single host. Multiple installations of such devices in a short window may indicate the unauthorized connection of remote access hardware, potentially used to establish a covert command and control channel.
Splunk (SPL)
