[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1219":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1219","T1219","Remote Access Tools",41,"MITRE","**What attackers do.** Attackers install or abuse legitimate remote access and remote monitoring tools, such as remote desktop support software, to get an interactive channel into a network. Because these tools are signed and widely used, they help with Command and Control while avoiding suspicion.\n\n**How to defend.** Approve a small set of remote access tools and block the rest using application control and network filtering of their cloud relay domains. Require MFA and central management for approved tools, and review their audit logs. Inventory endpoints regularly for unapproved remote access software.\n\n**Signs to look for.** Watch for new installations of remote access tools, especially on servers, tools launched shortly after a phishing click or helpdesk call, and connections to remote access vendor infrastructure from hosts that never used it before. A common gap is allowing any remote tool because the helpdesk uses one.","An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.\n\nRemote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system.\n\nInstallation of many remote access tools may also include persistence (e.g., the software's installation routine creates a Windows Service). Remote access modules\u002Ffeatures may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1219\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"xworm-rat-evolves-into-full-surveillance-platform-via-leaked-source-code","XWorm RAT Evolves Into Full Surveillance Platform via Leaked Source Code","2026-10-13T12:21:02.686+00:00",{"slug":25,"title":26,"published_at":27},"power-bi-abused-to-host-phishing-lures-deploying-rogue-remote-access-tools","Power BI Abused to Host Phishing Lures Deploying Rogue Remote Access Tools","2026-10-07T16:20:55.433+00:00",{"slug":29,"title":30,"published_at":31},"rmm-tool-abuse-drives-nearly-half-of-all-endpoint-incidents","RMM Tool Abuse Drives Nearly Half of All Endpoint Incidents","2026-10-01T14:20:35.214+00:00",{"slug":33,"title":34,"published_at":35},"phishing-campaigns-weaponize-legitimate-rmm-tools-for-stealthy-remote-access","Phishing Campaigns Weaponize Legitimate RMM Tools for Stealthy Remote Access","2026-09-30T18:20:46.497+00:00",{"slug":37,"title":38,"published_at":39},"csuite-phishing-campaign-hijacks-microsoft-365-sessions-and-installs-rmm-tools","CSuite Phishing Campaign Hijacks Microsoft 365 Sessions and Installs RMM Tools","2026-09-30T12:22:04.767+00:00",{"slug":41,"title":42,"published_at":43},"phishing-campaigns-weaponize-legitimate-rmm-tools-for-stealthy-persistent-access","Phishing Campaigns Weaponize Legitimate RMM Tools for Stealthy Persistent Access","2026-09-30T00:20:24.667+00:00",{"slug":45,"title":46,"published_at":47},"settra-ransomware-abuses-rmm-tools-for-persistence-while-sabotaging-recovery","Settra Ransomware Abuses RMM Tools for Persistence While Sabotaging Recovery","2026-09-17T18:21:03.162+00:00",{"slug":49,"title":50,"published_at":51},"fake-browser-windows-and-rogue-rmm-tools-enable-persistent-phishing-attacks","Fake Browser Windows and Rogue RMM Tools Enable Persistent Phishing Attacks","2026-09-09T16:22:43.252+00:00",{"slug":53,"title":54,"published_at":55},"multi-hop-google-redirects-used-to-bypass-phishing-defenses","Multi-Hop Google Redirects Used to Bypass Phishing Defenses","2026-09-08T22:20:56.137+00:00",{"slug":57,"title":58,"published_at":59},"rogue-screenconnect-clients-used-to-spread-worm-like-vbscript-malware","Rogue ScreenConnect Clients Used to Spread Worm-Like VBScript Malware","2026-09-07T15:20:24.288+00:00",{"slug":61,"title":62,"published_at":63},"backdoored-screenconnect-clients-fuel-worm-like-attack-campaign","Backdoored ScreenConnect Clients Fuel Worm-Like Attack Campaign","2026-09-07T12:20:52.421+00:00",{"slug":65,"title":66,"published_at":67},"rmm-phishing-campaign-hits-46-countries-us-as-primary-target","RMM Phishing Campaign Hits 46 Countries, US as Primary Target","2026-09-03T14:22:40.785+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",37,{"slug":75,"name":76,"problem":77,"stories":78},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",27,{"slug":80,"name":81,"problem":82,"stories":83},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",21,{"slug":85,"name":86,"problem":87,"stories":88},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",9,{"slug":90,"name":91,"problem":92,"stories":93},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",8,{"slug":95,"name":96,"problem":97,"stories":98},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",5,[100,106,112,117,121,126,130,135],{"family":101,"item":102,"code":103,"title":104,"together":105},"nist-800-53","si-3","SI-3","Malicious Code Protection",32,{"family":107,"item":108,"code":109,"title":110,"together":111},"cis","9","Control 9","Email and Web Browser Protections",29,{"family":107,"item":113,"code":114,"title":115,"together":116},"13","Control 13","Network Monitoring and Defense",23,{"family":101,"item":118,"code":119,"title":120,"together":116},"ac-17","AC-17","Remote Access",{"family":101,"item":122,"code":123,"title":124,"together":125},"at-2","AT-2","Literacy Training and Awareness",22,{"family":107,"item":127,"code":128,"title":129,"together":83},"14","Control 14","Security Awareness and Skills Training",{"family":107,"item":131,"code":132,"title":133,"together":134},"2","Control 2","Inventory and Control of Software Assets",20,{"family":136,"item":137,"code":138,"title":139,"together":140},"gdpr","32","Article 32","Security of processing",18]