PiKVM/Guermok Unauthorized USB KVM-over-IP Device Enumeration

Arnold Chan@slaz

•updated Sep 7, 2026•6•0•4

This rule monitors for the connection of specific KVM-over-IP hardware devices (e.g., PiKVM, Guermok) which can be used by an adversary to gain remote access to a system's physical keyboard, video, and mouse interface, effectively bypassing software-based security controls.