The BMC layer sits outside your endpoint security stack
Baseboard management controllers run beneath the operating system with their own network stack and credentials. A firmware research effort produced 18 vulnerabilities and nine exploits, and host-based detection does not cover this layer.