An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as VNC, Team Viewer, AnyDesk, ScreenConnect, LogMein, AmmyyAdmin, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy)
Remote access software may be installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary-controlled system.
Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
Installation of many remote access software may also include persistence (e.g., the software's installation routine creates a Windows Service). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| DE.AE-02.01 | Event analysis and detection | Mitigates | T1219 | Remote Access Software |
Comments
This diagnostic statement provides for implementation of methods to block similar future attacks via security tools such as antivirus and IDS/IPS to provide protection against threats and exploitation attempts.
References
|
| PR.IR-01.02 | Network device configurations | Mitigates | T1219 | Remote Access Software |
Comments
This diagnostic statement provides protection through secure network device configurations (e.g., firewall rules, ports, and protocols) aligned to security baselines. Using network appliances to block or filter network traffic can mitigate adversary abuse of remote access software.
References
|
| PR.IR-01.03 | Network communications integrity and availability | Mitigates | T1219 | Remote Access Software |
Comments
This diagnostic statement protects against Remote Access Software through the use of secure network configurations, architecture, implementations of zero trust architecture, and segmentation.
References
|
| PR.PS-01.08 | End-user device protection | Mitigates | T1219 | Remote Access Software |
Comments
This diagnostic statement protects against Remote Access Software through the use of limiting access to resources to only authorized devices, management of personal computing devices, network intrusion prevention, and the use of antimalware.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CA-07 | Continuous Monitoring | mitigates | T1219 | Remote Access Software | |
| CM-06 | Configuration Settings | mitigates | T1219 | Remote Access Software | |
| AC-17 | Remote Access | mitigates | T1219 | Remote Access Software | |
| SI-10 | Information Input Validation | mitigates | T1219 | Remote Access Software | |
| SI-15 | Information Output Filtering | mitigates | T1219 | Remote Access Software | |
| SI-03 | Malicious Code Protection | mitigates | T1219 | Remote Access Software | |
| SI-07 | Software, Firmware, and Information Integrity | mitigates | T1219 | Remote Access Software | |
| CM-02 | Baseline Configuration | mitigates | T1219 | Remote Access Software | |
| CM-07 | Least Functionality | mitigates | T1219 | Remote Access Software | |
| SI-04 | System Monitoring | mitigates | T1219 | Remote Access Software | |
| AC-03 | Access Enforcement | mitigates | T1219 | Remote Access Software | |
| AC-04 | Information Flow Enforcement | mitigates | T1219 | Remote Access Software | |
| SC-07 | Boundary Protection | mitigates | T1219 | Remote Access Software |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.hacking.vector.Desktop sharing software | Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two | related-to | T1219 | Remote Access Software | |
| action.malware.variety.Adminware | System or network utilities (e.g., PsTools, Netcat) | related-to | T1219 | Remote Access Software |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| azure_firewall | Azure Firewall | technique_scores | T1219 | Remote Access Software |
Comments
This control can be used to limit outgoing traffic to only sites and services used by authorized remote access tools. This is scored as partial because it doesn't protect against an adversary using an authorized remote access tool for malicious activity.
References
|
| azure_network_security_groups | Azure Network Security Groups | technique_scores | T1219 | Remote Access Software |
Comments
This control can be used to restrict network communications to protect sensitive enclaves that may mitigate some of the procedure examples of this technique.
References
|
| azure_network_watcher_traffic_analytics | Azure Network Watcher: Traffic Analytics | technique_scores | T1219 | Remote Access Software |
Comments
This control can detect network traffic associated with this technique.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| cloud_ngfw | Cloud Next-Generation Firewall (NGFW)_ | technique_scores | T1219 | Remote Access Software |
Comments
Cloud NGFW can allow or deny traffic based on the traffic's protocol, destination ports, sources, and destinations. This functionality can be used to only allow remote access software from trusted hosts (i.e., only allow remote access traffic from certain hosts). This mapping is given a score of Partial because even though it can restrict remote access software traffic from untrusted hosts, it cannot protect against an adversary using a trusted host that is permitted to use remote access software as part of an attack.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| amazon_virtual_private_cloud | Amazon Virtual Private Cloud | technique_scores | T1219 | Remote Access Software |
Comments
VPC security groups and network access control lists (NACLs) can be used to limit outgoing traffic to only sites and services used by authorized remote access tools. This is scored as partial because it doesn't protect against an adversary using an authorized remote access tool for malicious activity.
References
|
| aws_network_firewall | AWS Network Firewall | technique_scores | T1219 | Remote Access Software |
Comments
AWS Network Firewall has the ability to pass, drop, or alert on traffic based on the network protocol as well as perform deep packet inspection on the payload. This functionality can be used to only allow remote access software from trusted hosts (i.e., only allow remote access traffic from certain hosts). This mapping is given a score of Partial because even though it can restrict remote access software traffic from untrusted hosts, it cannot protect against an adversary using a trusted host that is permitted to use remote access software as part of an attack.
References
|