PiKVM/Guermok Unauthorized USB KVM-over-IP Device Enumeration
This rule monitors for the connection of specific KVM-over-IP hardware devices (e.g., PiKVM, Guermok) which can be used by an adversary to gain remote access to a system's physical keyboard, video, and mouse interface, effectively bypassing software-based security controls.
Microsoft Sentinel (KQL)
