An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management.[1][2][3] Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system.
Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a Windows Service). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).[4][5]
Top 14%of all ATT&CK techniques for number of groups
13 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has used MeshCentral and ConnectWise to gain initial access, to run administrative command queries and to deploy the custom lateral movement and defacement script [victim_abbreviation]_fanout.sh.12
Has leveraged Remote Access Software for lateral movement and data exfiltration.1234Medusa Group has also been known to utilize Remote Access Software such as AnyDesk, Atera, ConnectWise, eHorus, N-Able, PDQ Deploy, PDQ Inventory, SimpleHelp and Splashtop.2
During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels.1
2009–2011
All 2 campaigns for this technique
7 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has utilized remote access software including AnyDesk client through the “adc” module.123InvisibleFerret has also downloaded the AnyDesk client should it not already exist on the compromised host by searching for C:/Program Files(x86)/AnyDesk/AnyDesk.exe.4
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavior-Chain Detection for Remote Access Tools (Tool-Agnostic)
Enterprise
3 platforms
AN1366 · Windows
Chain of remote access tool behavior: (1) initial execution of remote-control/assist agent or GUI under user context; (2) persistence via service or autorun; (3) long-lived outbound connection/tunnel to external infrastructure; (4) interactive control signals such as shell or file-manager child processes spawned by the RAT parent.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
TimeWindow
Bind exec→service→egress events; extend for staged deployments.
DaemonAllowlist
Approved .service names/paths to avoid flagging corporate agents.
SuspiciousChildProcesses
Define shells/interpreters considered anomalous when spawned by GUI/agent parents.
EgressHeuristics
Flow heuristics for long-lived, client-heavy connections post-install.
AN1368 · macOS
Electron/GUI or headless RAT execution followed by LaunchAgent/Daemon persistence and persistent external connections; interactive children (osascript/sh/curl) spawned by parent.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Consider disabling unnecessary remote connection functionality, including both unapproved software installations and specific features built into supported applications.
Network intrusion detection and prevention systems that use network signatures may be able to prevent traffic to remote access services.
Tests15Executorspowershell 15Need elevation14 of 15Have prerequisites13Have cleanup14Platformswindows
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
TeamViewer Files Detected Test on Windows
windows
powershell
Required
1
Yes
An adversary may attempt to trick the user into downloading teamviewer and using this to maintain access to the machine. Download of TeamViewer installer will be at the destination location when sucessfully executed.
An adversary may attempt to trick the user into downloading AnyDesk and use to establish C2. Download of AnyDesk installer will be at the destination location and ran when sucessfully executed.
Inputs
Name
Description
Type
Default Value
download_url
url to download AnyDesk from
url
https://download.anydesk.com/AnyDesk.exe
installer_path
where the AnyDesk will be downloaded to or already is located
An adversary may attempt to trick the user into downloading LogMeIn and use to establish C2. Download of LogMeIn installer will be at the destination location and ran when sucessfully executed.
Inputs
Name
Description
Type
Default Value
download_url
url to download LogMeIn from
url
https://secure.logmein.com/LogMeInIgnition.msi
installer_path
where the installer will be downloaded to or already is located
An adversary may attempt to trick the user into downloading GoToAssist and use to establish C2. Download of GoToAssist installer will be at the destination location and ran when sucessfully executed.
ScreenConnect Application Download and Install on Windows
windows
powershell
Required
—
Yes
An adversary may attempt to trick the user into downloading ScreenConnect for use as a C2 channel. Download of ScreenConnect installer will be in the Downloads directory.
Msiexec will be used to quietly insall ScreenConnect.
Attack Commandsrun with powershellelevation required (root or admin)
An adversary may attempt to trick the user into downloading Ammyy Admin Remote Desktop Software for use as a C2 channel.
Upon successful execution, Ammyy Admin will be executed.
Inputs
Name
Description
Type
Default Value
Ammyy_Admin_Path
Path of Ammyy Admin executable
path
PathToAtomicsFolder\..\ExternalPayloads\ammyy.exe
Attack Commandsrun with powershellelevation required (root or admin)
An adversary may attempt to trick the user into downloading RemotePC Software for use as a C2 channel.
Upon successful execution, RemotePC will be executed.
A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as NetSupport to provide the operator with access to the network using legitimate services.
A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as UltraViewer to provide the operator with access to the network using legitimate services.
An adversary may attempt to trick the user into downloading MSP360 Connect for use as a C2 channel.
Upon successful execution, MSP360 Connect will be executed.
Inputs
Name
Description
Type
Default Value
MSP360_Connect_Path
Path of MSP360 executable
path
$env:ProgramFiles\Connect\Connect.exe
MSP360_Download_Url
URL to download MSP360 Connect from
url
—
Attack Commandsrun with powershellelevation required (root or admin)
An adversary may attempt to trick the user into downloading RustDesk and use this to maintain access to the machine.
Download of RustDesk installer will be at the destination location when successfully executed.
An adversary may attempt to use Splashtop Streamer to gain unattended remote interactive access. Upon successful execution, Splashtop streamer will be executed.
Inputs
Name
Description
Type
Default Value
srserver_exe
Splashtop streamer installation executables
string
SRServer.exe
Attack Commandsrun with powershellelevation required (root or admin)
Top 13%of all ATT&CK techniques for number of rules
Showing 1-21 of 21 rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Splunk
The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...)
The following analytic detects DNS queries to domains associated with known remote access software such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. (...)
The following analytic detects the execution of processes with file or code signing attributes from known remote access software within the environment. (...)
The following analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. (...)
This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of Remote Monitoring and Mangement applications. (...)
Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.
The following analytic identifies the loading of four specific Windows DLLs (credui.dll, dbghelp.dll, samcli.dll, winhttp.dll) by a non-standard process. (...)
The following analytic detects the creation or modification of Windows registry entries related to the Remote Manipulator System (RMS) Remote Admin tool. (...)