tfMITRE ATT&CK sub-technique

Remote Desktop Software T1219.002

sub-technique of T1219 Remote Access Tools

Tactic: Command and Control
Platforms: Linux, macOS, Windows
Version: 1.0
Created: 24 March 2025
Last modified: 12 May 2026

An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as VNC, Team Viewer, AnyDesk, ScreenConnect, LogMein, AmmyyAdmin, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.[1][2][3] Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.[4][5]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 17%

Threat groups83rd percentile · 83% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 12%

Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesTop 5%

Detection rules95th percentile · 95% of ATT&CK techniques have this many detection rules written or fewer.

Remote Desktop Software MITRE reference T1219.002

Top 17%of all ATT&CK techniques for number of groups

11 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Has installed NetBird on victim devices to create a mesh network that facilitated control of several victim devices at once.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

Storm-0501G1053 ↗

Has used legitimate remote monitoring and management (RMM) tools including AnyDesk, NinjaOne, and Level.io.1

created 2025-10-191 reference

Contagious InterviewG1052 ↗

Has downloaded remote management and monitoring software such as “AnyDesk” for post compromise activities.1 2 3 4 5

created 2025-10-195 referencesaka DeceptiveDevelopment

Storm-1811G1046 ↗

Has abused multiple types of legitimate remote access software and tools, such as ScreenConnect, NetSupport Manager, and AnyDesk.1 2

created 2025-03-142 references

Scattered SpiderG1015 ↗

In addition to directing victims to run remote software, Scattered Spider members themselves also deploy RMM software including TeamViewer, AnyDesk, LogMeIn, ngrok, and ConnectWise to establish persistence on the compromised network.1 2 3 4 5

created 2023-07-055 referencesaka Roasted 0ktapus

Mustang PandaG0129 ↗

Has installed TeamViewer on targeted systems.1

created 2021-04-121 referenceaka TA416

All 11 groups for this technique · 6 newest in this preview

Offense vs defense T1219.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 3Sigma rules (cumulative) · 46Splunk ESCU (cumulative) · 0

first rule: 2018 Q1 · 3 of 3 campaigns plotted

Remote Desktop Software detection strategy DET0259

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Remote Desktop Software Execution and Beaconing Detection

Enterprise

3 platforms

AN0714 · Windows

Adversary installation or use of RMM software (e.g., TeamViewer, AnyDesk, ScreenConnect) followed by outbound beaconing or remote session establishment

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Firewall Rule ModificationDC0051	WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall	new rule allowing inbound or outbound connections for remote desktop software
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
Image	RMM software can vary; defenders should update rules to account for additional binaries (e.g., ConnectWise, Zoho Assist)
DestinationPort	RMM software may use configurable or random high ports outside of standard (e.g., 7070, 5650)
ParentImage	Expected parent process may vary in different enterprise contexts
TimeWindow	Correlation window for install-to-beacon or process-to-network event should match operational environment

AN0715 · Linux

Execution of known or custom VNC/remote desktop daemons or tunneling agents that initiate external communication after launch

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Network Connection CreationDC0082	NSM:Flow	outbound connections to RMM services or to unusual destination ports

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
binary_name	Custom-compiled or renamed VNC servers (e.g., x11vnc, tightvncserver) may require local tuning
OutboundIPRange	Destination IP or ASN may shift depending on geolocation of cloud-hosted RMM backends

AN0716 · macOS

Initiation of remote desktop sessions via AnyDesk, TeamViewer, or Chrome Remote Desktop accompanied by unexpected user logins or system modifications

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	launch of remote desktop app or helper binary
Network Connection CreationDC0082	macos:unifiedlog	network sessions initiated by remote desktop apps

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
process_signature	App may be notarized and signed differently depending on distribution method (App Store vs .pkg)
sandbox_exception	If the remote desktop tool circumvents sandbox, it may produce additional telemetry in local TCC logs

Remote Desktop Software detections T1219.002

46 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 5%of all ATT&CK techniques for number of rules

Product

(none) 3

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs