Hands-on-keyboard describes intrusion activity carried out by a human operator in real time, rather than by fully automated malware alone. The attacker logs in, moves through systems, runs commands, steals data, or launches payloads using interactive control. This often happens after initial access has already been gained through stolen credentials, phishing, abused remote access tools, or a compromised admin session.
It matters because manual control lets attackers adapt quickly to what they find. They can disable defenses, choose valuable targets, and time actions to cause maximum disruption, which makes detection harder than with scripted attacks. Defenders often look for signs such as unusual remote sessions, abnormal administrator behavior, lateral movement, and command-line activity from accounts that rarely use it. In ransomware cases, hands-on-keyboard behavior can mean the difference between a noisy, automated spread and a carefully managed intrusion that targets live systems and business-critical files.