Remote Access Tools

T1219

Technique with 3 sub-techniques.View on attack.mitre.org

About this technique

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system.

Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a Windows Service). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).

Detection rules65

Rules on DetectionCode tagged with T1219 or one of its sub-techniques.

Sigma49

Rule	Level	Log source	Technique
Antivirus - APT Malware Signature	critical	NULL / antivirus	T1219.002
Antivirus - Exploitation Framework Signature	critical	NULL / antivirus	T1219.002
Antivirus - Remote Access Tools Signature	critical	NULL / antivirus	T1219.002
HackTool - Inveigh Execution Artefacts	critical	windows / file_event	T1219.002
Atera Agent Installation	high	windows / NULL	T1219.002
HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators	high	windows / file_event	T1219.002
Hijack Legit RDP Session to Move Laterally	high	windows / file_event	T1219.002
Remote Access Tool - Anydesk Execution From Suspicious Folder	high	windows / process_creation	T1219.002
Remote Access Tool - AnyDesk Silent Installation	high	windows / process_creation	T1219.002
Remote Access Tool - Renamed MeshAgent Execution - MacOS	high	macos / process_creation	T1219.002
Remote Access Tool - Renamed MeshAgent Execution - Windows	high	windows / process_creation	T1219.002
Renamed Visual Studio Code Tunnel Execution	high	windows / process_creation	T1219
Suspicious Binary Writes Via AnyDesk	high	windows / file_event	T1219.002
Suspicious Mstsc.EXE Execution With Local RDP File	high	windows / process_creation	T1219.002
Suspicious TSCON Start as SYSTEM	high	windows / process_creation	T1219.002
Suspicious Velociraptor Child Process	high	windows / process_creation	T1219
Anydesk Temporary Artefact	medium	windows / file_event	T1219.002
DNS Query To AzureWebsites.NET By Non-Browser Process	medium	windows / dns_query	T1219.002
DNS Query To Remote Access Software Domain From Non-Browser App	medium	windows / dns_query	T1219.002
GoToAssist Temporary Installation Artefact	medium	windows / file_event	T1219.002
Installation of TeamViewer Desktop	medium	windows / file_event	T1219.002
Mesh Agent Service Installation	medium	windows / NULL	T1219.002
OpenEDR Spawning Command Shell	medium	windows / process_creation	T1219
Potential Amazon SSM Agent Hijacking	medium	windows / process_creation	T1219.002
Potential Linux Amazon SSM Agent Hijacking	medium	linux / process_creation	T1219.002
Potential Remote Desktop Connection to Non-Domain Host	medium	windows / NULL	T1219.002
Potentially Suspicious File Creation by OpenEDR's ITSMService	medium	windows / file_event	T1219
Remote Access Tool - AnyDesk Execution	medium	windows / process_creation	T1219.002
Remote Access Tool - AnyDesk Incoming Connection	medium	windows / network_connection	T1219.002
Remote Access Tool - AnyDesk Piped Password Via CLI	medium	windows / process_creation	T1219.002
Remote Access Tool - GoToAssist Execution	medium	windows / process_creation	T1219.002
Remote Access Tool - LogMeIn Execution	medium	windows / process_creation	T1219.002
Remote Access Tool - MeshAgent Command Execution via MeshCentral	medium	windows / process_creation	T1219.002
Remote Access Tool - NetSupport Execution	medium	windows / process_creation	T1219.002
Remote Access Tool - Potential MeshAgent Execution - MacOS	medium	macos / process_creation	T1219.002
Remote Access Tool - Potential MeshAgent Execution - Windows	medium	windows / process_creation	T1219.002
Remote Access Tool - ScreenConnect Execution	medium	windows / process_creation	T1219.002
Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution	medium	windows / process_creation	T1219.002
Remote Access Tool - Simple Help Execution	medium	windows / process_creation	T1219.002
Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server	medium	windows / process_creation	T1219
Remote Access Tool - UltraViewer Execution	medium	windows / process_creation	T1219.002
ScreenConnect Temporary Installation Artefact	medium	windows / file_event	T1219.002
TacticalRMM Service Installation	medium	windows / NULL	T1219.002
TeamViewer Domain Query By Non-TeamViewer Application	medium	windows / dns_query	T1219.002
TeamViewer Remote Session	medium	windows / file_event	T1219.002
Use of UltraVNC Remote Access Software	medium	windows / process_creation	T1219.002
Visual Studio Code Tunnel Execution	medium	windows / process_creation	T1219
Mstsc.EXE Execution With Local RDP File	low	windows / process_creation	T1219.002
QuickAssist Execution	low	windows / process_creation	T1219.002

Splunk16

Rule	Type	Risk	Data source	Technique
Cisco Secure Firewall - Communication Over Suspicious Ports	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event	T1219
Cisco Secure Firewall - Remote Access Software Usage Traffic	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event	T1219
Detect Remote Access Software Usage DNS	Anomaly	NULL	Sysmon EventID 22	T1219
Detect Remote Access Software Usage File	Anomaly	NULL	Sysmon EventID 11	T1219
Detect Remote Access Software Usage FileInfo	Anomaly	NULL	Sysmon EventID 1	T1219
Detect Remote Access Software Usage Process	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1219
Detect Remote Access Software Usage Registry	Anomaly	NULL	Sysmon EventID 13	T1219
Detect Remote Access Software Usage Traffic	Anomaly	NULL	Palo Alto Network Traffic	T1219
Detect Remote Access Software Usage URL	Anomaly	NULL	Palo Alto Network Threat	T1219
HTTP RMM User Agent	Anomaly	NULL	Suricata	T1219
Windows Level RMM PowerShell Script Installer	Anomaly	NULL	Powershell Script Block Logging 4104	T1219
Windows Level RMM Watchdog Task Created	Anomaly	NULL	Windows Event Log Security 4698	T1219
Windows Remote Access Software BRC4 Loaded Dll	Anomaly	NULL	Sysmon EventID 7	T1219
Windows Remote Access Software Hunt	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1219
Windows Remote Access Software RMS Registry	TTP	NULL	Sysmon EventID 13	T1219
Windows RMM Tool Execution	Anomaly	NULL	Sysmon EventID 1	T1219

Sub-techniques3

ID	Name	Examples
T1219.001	IDE Tunneling	3
T1219.002	Remote Desktop Software	15
T1219.003	Remote Access Hardware	0

Groups13

Software7

Carbanak Dridex Egregor Hildegard InvisibleFerret RTM TrickBot

Campaigns2

Night Dragon Operation AkaiRyū

Procedure examples22

Groups13

Used by	Procedure example
GroupAkira	Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments. Arctic Wolf Akira 2023 Secureworks GOLD SAHARA
GroupBlackByte	BlackByte has used tools such as AnyDesk in victim environments. Microsoft BlackByte 2023 Picus BlackByte 2022
GroupCarbanak	Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems. Group-IB Anunak
GroupCobalt Group	Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost. Group IB Cobalt Aug 2017 PTSecurity Cobalt Dec 2016 PTSecurity Cobalt Group Aug 2017
GroupDarkVishnya	DarkVishnya used DameWare Mini Remote Control for lateral movement. Securelist DarkVishnya Dec 2018
GroupFIN7	FIN7 has utilized the remote management tool Atera to download malware to a compromised system. Mandiant FIN7 Apr 2022
GroupGOLD SOUTHFIELD	GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool "ConnectWise Control" to deploy REvil. Tetra Defense Sodinokibi March 2020
GroupINC Ransom	INC Ransom has used AnyDesk and PuTTY on compromised systems. Huntress INC Ransom Group August 2023 Huntress INC Ransomware May 2024 SOCRadar INC Ransom January 2024 SentinelOne INC Ransomware

View all 13 groups examples

Software7

Used by	Procedure example
MalwareCarbanak	Carbanak has a plugin for VNC and Ammyy Admin Tool. FireEye CARBANAK June 2017
MalwareDridex	Dridex contains a module for VNC. Dell Dridex Oct 2015
MalwareEgregor	Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines. Cyble Egregor Oct 2020
MalwareHildegard	Hildegard has established tmate sessions for C2 communications. Unit 42 Hildegard Malware
MalwareInvisibleFerret	InvisibleFerret has utilized remote access software including AnyDesk client through the “adc” module. InvisibleFerret has also downloaded the AnyDesk client should it not already exist on the compromised host by searching for `C:/Program Files(x86)/AnyDesk/AnyDesk.exe`. ESET Contagious Interview BeaverTail InvisibleFerret February 2025 Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023 Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024
MalwareRTM	RTM has the capability to download a VNC module from command and control (C2). ESET RTM Feb 2017
MalwareTrickBot	TrickBot uses vncDll module to remote control the victim machine. Bitdefender Trickbot March 2020 ESET Trickbot Oct 2020

Campaigns2

Used by	Procedure example
CampaignNight Dragon	During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels. McAfee Night Dragon
CampaignOperation AkaiRyū	During Operation AkaiRyū, MirrorFace used remote access tools including PuTTY. ESET MirrorFace 2025

References5

Chrome Remote Desktop Open source
Huntress. (n.d.). Retrieved March 14, 2024.
CrowdStrike 2015 Global Threat Report Open source
CrowdStrike Intelligence. (2016). 2015 Global Threat Report. Retrieved April 11, 2018.
CrySyS Blog TeamSpy Open source
CrySyS Lab. (2013, March 20). TeamSpy – Obshie manevri. Ispolzovat’ tolko s razreshenija S-a. Retrieved April 11, 2018.
Google Chrome Remote Desktop Open source
Google. (n.d.). Retrieved March 14, 2024.
Symantec Living off the Land Open source
Wueest, C., Anand, H. (2017, July). Living off the land and fileless attack techniques. Retrieved April 10, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.