THREATNOIR
Subscribe
MITRE ATT&CK · T1219

Remote Access Tools

MITRE · cited in 41 of our lessons

Explanation

What attackers do. Attackers install or abuse legitimate remote access and remote monitoring tools, such as remote desktop support software, to get an interactive channel into a network. Because these tools are signed and widely used, they help with Command and Control while avoiding suspicion.

How to defend. Approve a small set of remote access tools and block the rest using application control and network filtering of their cloud relay domains. Require MFA and central management for approved tools, and review their audit logs. Inventory endpoints regularly for unapproved remote access software.

Signs to look for. Watch for new installations of remote access tools, especially on servers, tools launched shortly after a phishing click or helpdesk call, and connections to remote access vendor infrastructure from hosts that never used it before. A common gap is allowing any remote tool because the helpdesk uses one.

Open the technique on MITRE ATT&CK
The official text
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access. Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system. Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a Windows Service). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 41.