Hands-on-keyboard activity is direct human control during an intrusion. Instead of a fully automated script running end to end, an operator is actively steering the attack, making decisions, typing commands, adjusting payloads, and reacting to what they see on the target.
This matters because human oversight makes intrusions more flexible and harder to model as a single static technique. Attackers often use automation for scanning or credential testing, then switch to hands-on-keyboard work for privilege escalation, lateral movement, data discovery, or adapting malware after defenses interfere. For defenders, this phase is important because it can leave interactive clues: unusual remote sessions, command-line use, admin tools launched from unexpected hosts, and sequences of behavior that follow reconnaissance or initial access. Security teams look for these correlations to tell real operator activity apart from background noise and automated probing.