T1219
Remote Access Tools
Linux · macOS · Windows2 pieces on this siteT1219 on attack.mitre.org
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions.
If this is happening now
Checklists and playbooks to open while the alert is still live.
How to find what an operator left behind
You have evicted somebody, or believe you have, and need to be sure there is no way back in.
A remote access tool nobody installed
AnyDesk, ScreenConnect, TeamViewer, Atera, Splashtop or something like them appears on a host where IT does not use it, or a sanctioned tool connects to an account or relay you do not own.
how MITRE says to see it
Behavior-Chain Detection for Remote Access Tools (Tool-Agnostic)
- Chain of remote access tool behavior: (1) initial execution of remote-control/assist agent or GUI under user context; (2) persistence via service or autorun; (3) long-lived outbound connection/tunnel to external infrastructure; (4) interactive control signals such as shell or file-manager child processes spawned by...
- Sequence of RAT agent execution, systemd persistence, and long-lived external egress; optional interactive shells spawned from the agent.
- Electron/GUI or headless RAT execution followed by LaunchAgent/Daemon persistence and persistent external connections; interactive children (osascript/sh/curl) spawned by parent.
what reduces it
- M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures may be able to prevent traffic to remote access services.
- M1037 Filter Network Traffic. Properly configure firewalls, application firewalls, and proxies to limit outgoing traffic to sites and services used by remote access software.
- M1034 Limit Hardware Installation. Block the use of IP-based KVM devices within the network if they are not required.
- M1038 Execution Prevention. Use application control to mitigate installation and use of unapproved software that can be used for remote access.
- M1042 Disable or Remove Feature or Program. Consider disabling unnecessary remote connection functionality, including both unapproved software installations and specific features built into supported applications.