EXPLORE
← Back to Explore
T1219.002

Remote Desktop Software

An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and mana...

LinuxmacOSWindows
48
Detections
3
Sources
9
Threat Actors

BY SOURCE

41sigma6elastic1crowdstrike_cql

PROCEDURES (23)

Command And Control9 detections

Auto-extracted: 9 detections for command and control

Process Creation Monitoring5 detections

Auto-extracted: 5 detections for process creation monitoring

File Monitoring3 detections

Auto-extracted: 3 detections for file monitoring

Command And Control3 detections

Auto-extracted: 3 detections for command and control

Bypass2 detections

Auto-extracted: 2 detections for bypass

Suspicious2 detections

Auto-extracted: 2 detections for suspicious

Remote2 detections

Auto-extracted: 2 detections for remote

Service2 detections

Auto-extracted: 2 detections for service

Remote2 detections

Auto-extracted: 2 detections for remote

Command And Control2 detections

Auto-extracted: 2 detections for command and control

Remote2 detections

Auto-extracted: 2 detections for remote

Exfiltrat2 detections

Auto-extracted: 2 detections for exfiltrat

Service2 detections

Auto-extracted: 2 detections for service

Dns1 detections

Auto-extracted: 1 detections for dns

Remote1 detections

Auto-extracted: 1 detections for remote

Dns1 detections

Auto-extracted: 1 detections for dns

C21 detections

Auto-extracted: 1 detections for c2

C21 detections

Auto-extracted: 1 detections for c2

Network Connection Monitoring1 detections

Auto-extracted: 1 detections for network connection monitoring

Child Process1 detections

Auto-extracted: 1 detections for child process

Cloud1 detections

Auto-extracted: 1 detections for cloud

General Monitoring1 detections

Auto-extracted: 1 detections for general monitoring

Script Execution Monitoring1 detections

Auto-extracted: 1 detections for script execution monitoring

DETECTIONS (48)

Antivirus Exploitation Framework Detection
sigmacritical
Anydesk Temporary Artefact
sigmamedium
Atera Agent Installation
sigmahigh
Detect Remote Monitoring and Management (RMM) Tools over DNS
crowdstrike_cql
DNS Query To AzureWebsites.NET By Non-Browser Process
sigmamedium
DNS Query To Remote Access Software Domain From Non-Browser App
sigmamedium
First Time Seen DNS Query to RMM Domain
elasticmedium
First Time Seen Remote Monitoring and Management Tool
elasticmedium
GoToAssist Temporary Installation Artefact
sigmamedium
HackTool - Inveigh Execution Artefacts
sigmacritical
HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators
sigmahigh
Hijack Legit RDP Session to Move Laterally
sigmahigh
Installation of TeamViewer Desktop
sigmamedium
Mesh Agent Service Installation
sigmamedium
Mstsc.EXE Execution With Local RDP File
sigmalow
Multiple Remote Management Tool Vendors on Same Host
elasticmedium
Newly Observed ScreenConnect Host Server
elastichigh
Potential Amazon SSM Agent Hijacking
sigmamedium
Potential Linux Amazon SSM Agent Hijacking
sigmamedium
Potential Remote Desktop Connection to Non-Domain Host
sigmamedium
QuickAssist Execution
sigmalow
Remote Access Tool - AnyDesk Execution
sigmamedium
Remote Access Tool - Anydesk Execution From Suspicious Folder
sigmahigh
Remote Access Tool - AnyDesk Incoming Connection
sigmamedium
Remote Access Tool - AnyDesk Piped Password Via CLI
sigmamedium
Remote Access Tool - AnyDesk Silent Installation
sigmahigh
Remote Access Tool - GoToAssist Execution
sigmamedium
Remote Access Tool - LogMeIn Execution
sigmamedium
Remote Access Tool - MeshAgent Command Execution via MeshCentral
sigmamedium
Remote Access Tool - NetSupport Execution
sigmamedium
Remote Access Tool - Potential MeshAgent Execution - MacOS
sigmamedium
Remote Access Tool - Potential MeshAgent Execution - Windows
sigmamedium
Remote Access Tool - Renamed MeshAgent Execution - MacOS
sigmahigh
Remote Access Tool - Renamed MeshAgent Execution - Windows
sigmahigh
Remote Access Tool - ScreenConnect Execution
sigmamedium
Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution
sigmamedium
Remote Access Tool - Simple Help Execution
sigmamedium
Remote Access Tool - UltraViewer Execution
sigmamedium
Remote Management Access Launch After MSI Install
elasticmedium
ScreenConnect Temporary Installation Artefact
sigmamedium
Suspicious Binary Writes Via AnyDesk
sigmahigh
Suspicious Mstsc.EXE Execution With Local RDP File
sigmahigh
Suspicious Shell Execution via Velociraptor
elasticmedium
Suspicious TSCON Start as SYSTEM
sigmahigh
TacticalRMM Service Installation
sigmamedium
TeamViewer Domain Query By Non-TeamViewer Application
sigmamedium
TeamViewer Remote Session
sigmamedium
Use of UltraVNC Remote Access Software
sigmamedium