T1219.002 Remote Desktop Software
Sub-technique of T1219 Remote Access Tools
An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`,…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Antivirus - Exploitation Framework Signaturecriticalstable · antivirus
- HackTool - Inveigh Execution Artefactscriticaltest · windows
- Antivirus - APT Malware Signaturecriticalexperimental · antivirus
- Antivirus - Remote Access Tools Signaturecriticalexperimental · antivirus
- Atera Agent Installationhightest · windows
- HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicatorshightest · windows
- Hijack Legit RDP Session to Move Laterallyhightest · windows
- Potential CSharp Streamer RAT Loading .NET Executable Imagehightest · windows
- Potential SocGholish Second Stage C2 DNS Queryhightest · windows
- Remote Access Tool - AnyDesk Silent Installationhightest · windows
- Remote Access Tool - Anydesk Execution From Suspicious Folderhightest · windows
- Suspicious Binary Writes Via AnyDeskhightest · windows
- Suspicious Mstsc.EXE Execution With Local RDP Filehightest · windows
- Suspicious TSCON Start as SYSTEMhightest · windows
- Remote Access Tool - Renamed MeshAgent Execution - MacOShighexperimental · macos
- Remote Access Tool - Renamed MeshAgent Execution - Windowshighexperimental · windows
- Anydesk Temporary Artefactmediumtest · windows
- DNS Query To AzureWebsites.NET By Non-Browser Processmediumtest · windows
- DNS Query To Remote Access Software Domain From Non-Browser Appmediumtest · windows
- GoToAssist Temporary Installation Artefactmediumtest · windows
- Installation of TeamViewer Desktopmediumtest · windows
- Mesh Agent Service Installationmediumtest · windows
- Potential Amazon SSM Agent Hijackingmediumtest · windows
- Potential Linux Amazon SSM Agent Hijackingmediumtest · linux
- Potential Remote Desktop Connection to Non-Domain Hostmediumtest · windows
Showing 25 of 40.
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.