tfMITRE ATT&CK technique

Remote Access Tools T1219

Tactic: Command and Control
Platforms: Linux, macOS, Windows
Version: 3.0
Created: 18 April 2018
Last modified: 12 May 2026
Contributors: Matt Kelly, @breakersall; Zachary Stanford, @svch0st; Dray Agha, @Purp1eW0lf, Huntress Labs

Sub-techniques 367 rules across the family · 21 mapped directly to T1219 · 1 of 3 carry rules

.001IDE Tunneling0 .002Remote Desktop Software46 .003Remote Access Hardware0

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management.[1][2][3] Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 14%

Threat groups86th percentile · 86% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware71st pct

Tools & malware71st percentile · 71% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 13%

Detection rules87th percentile · 87% of ATT&CK techniques have this many detection rules written or fewer.

Remote Access Tools MITRE reference T1219

Top 14%of all ATT&CK techniques for number of groups

13 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ShinyHuntersG1057 ↗

Has used MeshCentral and ConnectWise to gain initial access, to run administrative command queries and to deploy the custom lateral movement and defacement script [victim_abbreviation]_fanout.sh.1 2

created 2026-07-292 referencesaka UNC6240

Medusa GroupG1051 ↗

Has leveraged Remote Access Software for lateral movement and data exfiltration.1 2 3 4 Medusa Group has also been known to utilize Remote Access Software such as AnyDesk, Atera, ConnectWise, eHorus, N-Able, PDQ Deploy, PDQ Inventory, SimpleHelp and Splashtop.2

created 2025-10-155 references

BlackByteG1043 ↗

Has used tools such as AnyDesk in victim environments.1 2

created 2024-12-162 referencesaka Hecamede

INC RansomG1032 ↗

Has used AnyDesk and PuTTY on compromised systems.1 2 3 4

created 2024-06-064 referencesaka GOLD IONIC

AkiraG1024 ↗

Uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.1 2

created 2024-02-202 referencesaka GOLD SAHARA

TeamTNTG0139 ↗

Has established tmate sessions for C2 communications.1 2

created 2021-10-012 references

All 13 groups for this technique · 6 newest in this preview

7 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

InvisibleFerretS1245 ↗

Has utilized remote access software including AnyDesk client through the “adc” module.1 2 3 InvisibleFerret has also downloaded the AnyDesk client should it not already exist on the compromised host by searching for C:/Program Files(x86)/AnyDesk/AnyDesk.exe.4

created 2025-10-17MALWAREcarried by 1 group

HildegardS0601 ↗

Has established tmate sessions for C2 communications.1

created 2021-04-07MALWAREcarried by 1 group

EgregorS0554 ↗

Has checked for the LogMein event log in an attempt to encrypt files in remote machines.1

created 2020-12-29MALWARE

DridexS0384 ↗

Contains a module for VNC.1

created 2019-05-30MALWAREcarried by 2 groups

TrickBotS0266 ↗

Uses vncDll module to remote control the victim machine.1 2

created 2018-10-17MALWAREcarried by 2 groups

RTMS0148 ↗

Has the capability to download a VNC module from command and control (C2).1

created 2017-05-31MALWAREcarried by 1 group

All 7 software entries for this technique · 6 newest in this preview

Offense vs defense T1219

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 15

first rule: 2022 Q2 · 0 of 2 campaigns plotted (Night Dragon (dated 2009), Operation AkaiRyū (dated 2004) fall before the 2019 window)

Remote Access Tools detection strategy DET0496

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavior-Chain Detection for Remote Access Tools (Tool-Agnostic)

Enterprise

3 platforms

AN1366 · Windows

Chain of remote access tool behavior: (1) initial execution of remote-control/assist agent or GUI under user context; (2) persistence via service or autorun; (3) long-lived outbound connection/tunnel to external infrastructure; (4) interactive control signals such as shell or file-manager child processes spawned by the RAT parent.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Windows Registry Key CreationDC0056	WinEventLog:Sysmon	EventCode=12
Service CreationDC0060	WinEventLog:System	EventCode=7045
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlation period binding start→persistence→egress→child (default 15m, adjust per environment).
UserContext	Differentiate help-desk/jump hosts and admin accounts from standard endpoints.
ProcessAllowlist	Known-good remote support tools; suppress expected events while still correlating anomalous sequences.
InstallPathRegex	Alert when services/agents execute from user-writable or temp paths.
ExternalIPAllowlist	Vendors’ support clouds/CDNs to reduce false positives on egress detection.
ShellSpawnRegex	Define which child shells from GUI parents are acceptable versus suspicious.
EgressHeuristics	Thresholds for session duration, connection counts, and bytes_out/bytes_in ratio.

AN1367 · Linux

Sequence of RAT agent execution, systemd persistence, and long-lived external egress; optional interactive shells spawned from the agent.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve: Agent/headless flags (listen/connect/reverse/tunnel) or remote-control binaries spawning shells
File CreationDC0039	auditd:PATH	WRITE: Drop of binaries/scripts in ~/.local, /tmp, or /opt tool dirs
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Bind exec→service→egress events; extend for staged deployments.
DaemonAllowlist	Approved .service names/paths to avoid flagging corporate agents.
SuspiciousChildProcesses	Define shells/interpreters considered anomalous when spawned by GUI/agent parents.
EgressHeuristics	Flow heuristics for long-lived, client-heavy connections post-install.

AN1368 · macOS

Electron/GUI or headless RAT execution followed by LaunchAgent/Daemon persistence and persistent external connections; interactive children (osascript/sh/curl) spawned by parent.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Process exec of remote-control apps or binaries with headless/connect flags
File CreationDC0039	macos:osquery	CREATE/MODIFY: Creation of LaunchAgents/Daemons plists in user/system locations
Network Connection CreationDC0082	macos:osquery	CONNECT: Long-lived connections from remote-control parents to external IPs/domains

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedAppBundlePaths	Legitimate remote-support apps under /Applications.
LaunchdAllowlist	Known-good LaunchAgents/Daemons identifiers.
TimeWindow	Window for correlating exec→launchd→egress events.
EgressHeuristics	Duration/volume thresholds for persistent sessions.

Tests15ExecutorsPowerShell 15Need elevation14 of 15Have prerequisites8Have cleanup14Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

TeamViewer Files Detected Test on Windows

windows

PowerShell

Required

—

Yes

AnyDesk Files Detected Test on Windows

windows

PowerShell

Required

—

Yes

LogMeIn Files Detected Test on Windows

windows

PowerShell

Required

—

Yes

GoToAssist Files Detected Test on Windows

windows

PowerShell

Required

—

Yes

ScreenConnect Application Download and Install on Windows

windows

PowerShell

Required

—

Yes

Ammyy Admin Software Execution

windows

PowerShell

Required

Yes

An adversary may attempt to trick the user into downloading Ammyy Admin Remote Desktop Software for use as a C2 channel. Upon successful execution, Ammyy Admin will be executed.

Input arguments

Name	Type	Default	Description
Ammyy_Admin_Path	path	PathToAtomicsFolder\..\ExternalPayloads\ammyy.exe	Path of Ammyy Admin executable

Attack command

Start-Process "#{Ammyy_Admin_Path}"

Cleanup command

Stop-Process -Name "Ammyy" -force -erroraction silentlycontinue

Prerequisite

Ammyy Admin must exist on disk at the specified location (#{Ammyy_Admin_Path})

Check

if (Test-Path "#{Ammyy_Admin_Path}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://web.archive.org/web/20140625232737/http://www.ammyy.com/AA_v3.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\ammyy.exe" -UseBasicParsing

GUID65344d0e-3cf5-426f-b26e-ae213546fc98

RemotePC Software Execution

windows

PowerShell

Required

Yes

An adversary may attempt to trick the user into downloading RemotePC Software for use as a C2 channel. Upon successful execution, RemotePC will be executed.

Input arguments

Name	Type	Default	Description
RemotePC_Path	path	PathToAtomicsFolder\..\ExternalPayloads\RemotePC.exe	Path of RemotePC executable

Attack command

Start-Process "#{RemotePC_Path}"

Cleanup command

Unregister-ScheduledTask -TaskName "RemotePC" -Confirm:$False -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "RPCServiceHealthCheck" -Confirm:$False -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "ServiceMonitor" -Confirm:$False -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "StartRPCService" -Confirm:$False -ErrorAction SilentlyContinue      
Stop-Process -Name "RemotePCPerformance" -force -erroraction silentlycontinue
Stop-Process -Name "RPCPerformanceService" -force -erroraction silentlycontinue
Stop-Process -Name "RemotePCUIU" -force -erroraction silentlycontinue
Stop-Process -Name "RPCDownloader" -force -erroraction silentlycontinue
Stop-Process -Name "RemotePCService" -force -erroraction silentlycontinue
Stop-Process -Name "RPCService" -force -erroraction silentlycontinue

Prerequisite

RemotePC must exist on disk at the specified location (#{RemotePC_Path})

Check

if (Test-Path "#{RemotePC_Path}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://static.remotepc.com/downloads/rpc/140422/RemotePC.exe" -OutFile "#{RemotePC_Path}" -UseBasicParsing

GUIDeaa61d7a-e2db-4db5-9589-e5c73e0a29fc

NetSupport - RAT Execution

windows

PowerShell

Required

Yes

A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as NetSupport to provide the operator with access to the network using legitimate services.

Input arguments

Name	Type	Default	Description
NetSupport_Path	path	PathToAtomicsFolder\..\ExternalPayloads\T1219_NetSupport.exe	Path to the NetSupport executable.

Attack command

Start-Process "#{NetSupport_Path}" -ArgumentList "/S /v/qn"

Cleanup command

Stop-Process -Name "client32" -force -erroraction silentlycontinue

Prerequisite

NetSupport must be downloaded and exist on the disk at the specified location. (#{NetSupport_Path})

Check

if (Test-Path "#{NetSupport_Path}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
(New-Object Net.WebClient).DownloadFile("https://nsproducts.azureedge.net/nsm-1270/en/Setup.exe","#{NetSupport_Path}")

GUIDe3075816-7520-4cf9-85a9-63af75782748

UltraViewer - RAT Execution

windows

PowerShell

Required

Yes

A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as UltraViewer to provide the operator with access to the network using legitimate services.

Input arguments

Name	Type	Default	Description
UltraViewer_Path	path	PathToAtomicsFolder\..\ExternalPayloads\T1219_UltraViewer.exe	Path to the UltraViewer executable.

Attack command

Start-Process -Wait -FilePath "#{UltraViewer_Path}" -Argument "/silent" -PassThru
Start-Process 'C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe'

Cleanup command

Stop-Process -Name "UltraViewer_Desktop" -Force -ErrorAction SilentlyContinue

Prerequisite

Ultraviewer installer must be downloaded and exist on the disk at the specified location. (#{UltraViewer_Path})

Check

if (Test-Path "#{UltraViewer_Path}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
(New-Object Net.WebClient).DownloadFile("https://www.ultraviewer.net/en/UltraViewer_setup_6.5_en.exe","#{UltraViewer_Path}")

GUIDac34ed92-fa98-4986-8f58-818d96a0d004

UltraVNC Execution

windows

PowerShell

Required

Yes

An adversary may attempt to trick the user into downloading UltraVNC for use as a C2 channel. Upon successful execution, UltraVNC will be executed.

Input arguments

Name	Type	Default	Description
UltraVNC_Viewer_Path	path	$env:ProgramFiles\'uvnc bvba\UltraVnc\vncviewer.exe'	Path of UltraVNC Viewer executable

Attack command

Start-Process #{UltraVNC_Viewer_Path}

Cleanup command

Stop-Process -Name "vncviewer" -force -erroraction silentlycontinue

Prerequisite

UltraVNC must exist at (#{UltraVNC_Viewer_Path})

Check

if (Test-Path #{UltraVNC_Viewer_Path}) {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://www.uvnc.eu/download/1381/UltraVNC_1_3_81_X64_Setup.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\vncsetup.exe"
start-process "PathToAtomicsFolder\..\ExternalPayloads\vncsetup.exe" /silent

GUIDe4903e9a-2448-4606-b4e1-b52883dc40d3

MSP360 Connect Execution

windows

PowerShell

Required

Yes

An adversary may attempt to trick the user into downloading MSP360 Connect for use as a C2 channel. Upon successful execution, MSP360 Connect will be executed.

Input arguments

Name	Type	Default	Description
MSP360_Connect_Path	path	$env:ProgramFiles\Connect\Connect.exe	Path of MSP360 executable
MSP360_Download_Url	url	—	URL to download MSP360 Connect from

Attack command

Start-Process #{MSP360_Connect_Path}

Cleanup command

Stop-Process -Name "Connect" -force -erroraction silentlycontinue

Prerequisite

MSP360 must exist at (#{MSP360_Connect_Path})

Check

if (Test-Path #{MSP360_Connect_Path}) {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\msp360connect.exe" "#{MSP360_Download_Url}"
start-process "PathToAtomicsFolder\..\ExternalPayloads\msp360connect.exe" /S

GUID472ce433-062b-481d-8a76-1e69d7ff2294

RustDesk Files Detected Test on Windows

windows

PowerShell

—

Yes

Splashtop Execution

windows

PowerShell

Required

Yes

An adversary may attempt to trick the user into downloading Splashtop for use as a C2 channel. Upon successful execution, Splashtop will be executed.

Input arguments

Name	Type	Default	Description
Splashtop_Path	path	${env:programfiles(x86)}\Splashtop\Splashtop Remote\Client for STP\strwinclt.exe	Path of Splashtop executable

Attack command

Start-Process "#{Splashtop_Path}"

Cleanup command

Stop-Process -Name "strwinclt" -force -erroraction silentlycontinue

Prerequisite

Splashtop must exist at "#{Splashtop_Path}"

Check

if (Test-Path "#{Splashtop_Path}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\splashtop_install.exe" "https://download.splashtop.com/winclient/STP/Splashtop_Personal_Win_v3.6.6.0.exe"
start-sleep 30
start-process "PathToAtomicsFolder\..\ExternalPayloads\splashtop_install.exe" /S  
start-sleep 30

GUID8617a9d2-a63d-4a49-88cc-132ec9b303a1

Splashtop Streamer Execution

windows

PowerShell

Required

—

An adversary may attempt to use Splashtop Streamer to gain unattended remote interactive access. Upon successful execution, Splashtop streamer will be executed.

Input arguments

Name	Type	Default	Description
srserver_exe	string	SRServer.exe	Splashtop streamer installation executables

Attack command

Start-Process -FilePath "C:Program Files (x86)\Splashtop\Splashtop Remote\Server\#{srserver_exe}"

Prerequisite

Splashtop Streamer must be installed in the location

Check

if (Test-Path "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\#{srserver_exe}") {exit 0} else {exit 1}

Satisfy

Write-Host Downloading Splashtop Streamer
New-Item -Type Directory "C:\Temp\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.splashtop.com/win/Splashtop_Streamer_Win_INSTALLER_v3.6.4.1.exe" -OutFile  "C:\Temp\ExternalPayloads\Splashtop.exe"
Write-Host Installing Splashtop Streamer
Start-Process "c:\Temp\ExternalPayloads\Splashtop.exe" -Wait -ArgumentList "/s"

GUID554b9eb9-a328-4ecb-abb9-46a115cb9a6a

Microsoft App Quick Assist Execution

windows

PowerShell

Required

—

Yes

Tests from Atomic Red Team (MIT licence) · technique definition

Remote Access Tools detections T1219

21 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 13%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs