MITRE ATT&CKsub-technique

T1219.002 Remote Desktop Software

Published 2025-03-24 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
Linux, macOS, Windows
Version
1.0
Created
2025-03-24

Description

An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment. Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1219 Remote Access Tools technique

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (3)

  • M1037 Filter Network Traffic mitigation
  • M1038 Execution Prevention mitigation
  • M1042 Disable or Remove Feature or Program mitigation

Referenced by MITRE ATT&CK · uses (16)

Referenced by Compliance · mitigates (5)

  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-13.4 Perform Traffic Filtering Between Network Segments CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • CIS-4.6 Securely Manage Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS Safeguard v8.1

References