Applied Cybernetics Group
T1219.002 Remote Desktop Software
- Technique
T1219.002- Tactics
- Command and Control
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 46
- Elastic, Splunk
- 13
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1219/002
MITRE description
An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software tools, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-15Google Threat Intelligence: Investigating Ephemeral Supply Chain Tampering
Detection coverage
SigmaHQ community rules
- Potential SocGholish Second Stage C2 DNS Query (emerging-threats)
- Potential CSharp Streamer RAT Loading .NET Executable Image (emerging-threats)
- Remote Access Tool - Action1 Arbitrary Code Execution and Remote Sessions (threat-hunting)
- Antivirus - APT Malware Signature (core)
- Antivirus - Exploitation Framework Signature (core)
- Antivirus - Remote Access Tools Signature (core)
- Potential Linux Amazon SSM Agent Hijacking (core)
- Remote Access Tool - Potential MeshAgent Execution - MacOS (core)
- Remote Access Tool - Renamed MeshAgent Execution - MacOS (core)
- Atera Agent Installation (core)
- Potential Remote Desktop Connection to Non-Domain Host (core)
- Mesh Agent Service Installation (core)
- TacticalRMM Service Installation (core)
- DNS Query To AzureWebsites.NET By Non-Browser Process (core)
- DNS Query To Remote Access Software Domain From Non-Browser App (core)
- TeamViewer Domain Query By Non-TeamViewer Application (core)
- Anydesk Temporary Artefact (core)
- Suspicious Binary Writes Via AnyDesk (core)
- GoToAssist Temporary Installation Artefact (core)
- HackTool - Inveigh Execution Artefacts (core)
- HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators (core)
- Installation of TeamViewer Desktop (core)
- ScreenConnect Temporary Installation Artefact (core)
- TeamViewer Remote Session (core)
- Hijack Legit RDP Session to Move Laterally (core)
Showing 25 of 46 community rules.
the full set is tagged attack.t1219.002 in
SigmaHQ.
Elastic and Splunk rules
- First Time Seen RMM Service Hostname from Network DNS (elastic)
- Multiple RMM Vendors Queried by a Single DNS Client (elastic)
- First Time Seen DNS Query to RMM Domain (elastic)
- Multiple Remote Management Tool Vendors on Same Host (elastic)
- First Time Seen Remote Monitoring and Management Tool (elastic)
- First Time Seen RMM Signer Across the Environment (elastic)
- Newly Observed ScreenConnect Host Server (elastic)
- Remote Management Access Launch After MSI Install (elastic)
- Potential RMM Execution from a Commonly Abused Web Service (elastic)
- RMM Software Installation from a Commonly Abused Web Service (elastic)
- RMM Software Installation from an Internet-Originated MSI (elastic)
- Suspicious Shell Execution via Velociraptor (elastic)
- Lure-Themed Internet-Delivered RMM Executable (elastic)