An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system.
Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a Windows Service). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1219 | Remote Access Tools |
Comments
Application firewalls and proxies can restrict access to websites, services, and destinations associated with unauthorized remote-access tools.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1219 | Remote Access Tools |
Comments
Network intrusion prevention solutions can use network signatures to block traffic associated with unauthorized remote-access services.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1219 | Remote Access Tools |
Comments
Configure network firewalls and proxies at segment boundaries to restrict outgoing traffic to sites and services associated with unauthorized remote-access software.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1219 | Remote Access Tools |
Comments
Removing unauthorized or unnecessary remote-access products and disabling embedded remote-support functionality directly eliminates those access channels.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1219 | Remote Access Tools |
Comments
Secure software management can limit administration to approved and securely configured remote-access products. The safeguard does not prevent an approved tool or account from being abused by an adversary.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1219 | Remote Access Tools |
Comments
Application-aware or destination-restricted firewall policies can block communications to unauthorized remote-access services. Tools communicating through generally permitted HTTPS may bypass basic port filtering.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1219 | Remote Access Tools |
Comments
Host firewall rules can block inbound or outbound communications associated with unauthorized remote access software. The firewall does not prevent the software from being installed or executed when it communicates over an allowed channel.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1219 | Remote Access Tools |
Comments
Application allowlisting prevents execution of unauthorized remote access tools (e.g., AnyDesk, TeamViewer, custom RATs). If not explicitly authorized, these binaries cannot execute, directly reducing adversary persistence and command-and-control capability.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.malware.variety.Adminware | System or network utilities (e.g., PsTools, Netcat) | related-to | T1219 | Remote Access Tools | |
| action.hacking.vector.Desktop sharing software | Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two | related-to | T1219 | Remote Access Tools |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| cloud_ngfw | Cloud Next-Generation Firewall (NGFW)_ | technique_scores | T1219 | Remote Access Tools |
Comments
Cloud NGFW can allow or deny traffic based on the traffic's protocol, destination ports, sources, and destinations. This functionality can be used to only allow remote access software from trusted hosts (i.e., only allow remote access traffic from certain hosts). This mapping is given a score of Partial because even though it can restrict remote access software traffic from untrusted hosts, it cannot protect against an adversary using a trusted host that is permitted to use remote access software as part of an attack.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| aws_network_firewall | AWS Network Firewall | technique_scores | T1219 | Remote Access Tools |
Comments
AWS Network Firewall has the ability to pass, drop, or alert on traffic based on the network protocol as well as perform deep packet inspection on the payload. This functionality can be used to only allow remote access software from trusted hosts (i.e., only allow remote access traffic from certain hosts). This mapping is given a score of Partial because even though it can restrict remote access software traffic from untrusted hosts, it cannot protect against an adversary using a trusted host that is permitted to use remote access software as part of an attack.
References
|
| amazon_virtual_private_cloud | Amazon Virtual Private Cloud | technique_scores | T1219 | Remote Access Tools |
Comments
VPC security groups and network access control lists (NACLs) can be used to limit outgoing traffic to only sites and services used by authorized remote access tools. This is scored as partial because it doesn't protect against an adversary using an authorized remote access tool for malicious activity.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1219.001 | IDE Tunneling | 3 |
| T1219.003 | Remote Access Hardware | 1 |
| T1219.002 | Remote Desktop Software | 7 |