MITRE ATT&CKtechnique

T1219 Remote Access Tools

Published 2018-04-18 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
Linux, macOS, Windows
Version
3.0
Created
2018-04-18

Description

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access. Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system. Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a Windows Service). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).

Related

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (5)

  • M1034 Limit Hardware Installation mitigation
  • M1037 Filter Network Traffic mitigation
  • M1038 Execution Prevention mitigation
  • M1042 Disable or Remove Feature or Program mitigation
  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · subtechnique of (3)

Referenced by MITRE ATT&CK · uses (22)

  • G1057 ShinyHunters group
  • C0060 Operation AkaiRyū campaign
  • S1245 InvisibleFerret software (malware)
  • G1051 Medusa Group group
  • G1043 BlackByte group
  • G1032 INC Ransom group
  • G1024 Akira group
  • C0002 Night Dragon campaign
  • G0139 TeamTNT group
  • S0601 Hildegard software (malware)
  • S0554 Egregor software (malware)
  • G0115 GOLD SOUTHFIELD group
  • G0105 DarkVishnya group
  • S0384 Dridex software (malware)
  • G0080 Cobalt Group group
  • S0266 TrickBot software (malware)
  • G0049 OilRig group
  • G0008 Carbanak group
  • G0034 Sandworm Team group
  • G0046 FIN7 group
  • S0030 Carbanak software (malware)
  • S0148 RTM software (malware)

Referenced by Compliance · mitigates (21)

  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-13.4 Perform Traffic Filtering Between Network Segments CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-2.5 Allowlist Authorized Software CIS Safeguard v8.1
  • CIS-4.4 Implement and Manage a Firewall on Servers CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • CIS-4.6 Securely Manage Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS Safeguard v8.1
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-15 Information Output Filtering NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References