T1219 Remote Access Software Mappings

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote access tools may be established and used post-compromise as alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system.

Admin tools such as TeamViewer have been used by several groups targeting institutions in countries of interest to the Russian state and criminal campaigns. (Citation: CrowdStrike 2015 Global Threat Report) (Citation: CrySyS Blog TeamSpy)

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-17 Remote Access Protects T1219 Remote Access Software
AC-3 Access Enforcement Protects T1219 Remote Access Software
AC-4 Information Flow Enforcement Protects T1219 Remote Access Software
CA-7 Continuous Monitoring Protects T1219 Remote Access Software
CM-2 Baseline Configuration Protects T1219 Remote Access Software
CM-6 Configuration Settings Protects T1219 Remote Access Software
CM-7 Least Functionality Protects T1219 Remote Access Software
SC-7 Boundary Protection Protects T1219 Remote Access Software
SI-10 Information Input Validation Protects T1219 Remote Access Software
SI-15 Information Output Filtering Protects T1219 Remote Access Software
SI-3 Malicious Code Protection Protects T1219 Remote Access Software
SI-4 System Monitoring Protects T1219 Remote Access Software
SI-7 Software, Firmware, and Information Integrity Protects T1219 Remote Access Software
action.hacking.vector.Desktop sharing software Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two related-to T1219 Remote Access Software
action.malware.variety.Adminware System or network utilities (e.g., PsTools, Netcat) related-to T1219 Remote Access Software
amazon_virtual_private_cloud Amazon Virtual Private Cloud technique_scores T1219 Remote Access Software
aws_network_firewall AWS Network Firewall technique_scores T1219 Remote Access Software