Remote Access Tools: Remote Desktop Software (T1219.002)

Tactic: Command and Control · Platforms: Linux, macOS, Windows

The interactive view maps 1 detection strategy, 3 mitigations, 11 threat groups, 1 software entry, 3 campaigns to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Remote Access Tools (T1219).

Overview

An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment. Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.

Explore

• Open T1219.002 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1219.002
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan