T1219 Remote Access Tools

Technique

T1219

Tactics

Command and Control

Research, 90 days

7

KEV CVEs mapped

1

SigmaHQ rules

6

Elastic, Splunk

41

thrunt rules

1

Active families

AsyncRAT, ConnectWise ScreenConnect (abuse), QuasarRAT, njRAT

Upstream

https://attack.mitre.org/techniques/T1219

MITRE description

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access. Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system. Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a [Windows Service](https://attack.mitre.org/techniques/T1543/003)). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

• CVE-2018-4878

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-30 Microsoft Threat Intelligence: From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
• 2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
• 2026-10-26 Arctic Wolf: Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access
• 2026-10-21 Group-IB: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
• 2026-10-15 GuidePoint GRIT: Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew
• 2026-09-29 Microsoft Threat Intelligence: Phishing Abuses RMM Tools for Persistent Access
• 2026-09-25 Google Threat Intelligence: ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

Detection coverage

thrunt rules

• t1505-003-peoplesoft-psemhub-webshell-drop

SigmaHQ community rules

• Potentially Suspicious File Creation by OpenEDR's ITSMService (core)
• OpenEDR Spawning Command Shell (core)
• Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server (core)
• Suspicious Velociraptor Child Process (core)
• Visual Studio Code Tunnel Execution (core)
• Renamed Visual Studio Code Tunnel Execution (core)

Elastic and Splunk rules

• Potential Traffic Tunneling using QEMU (elastic)
• Potential Tunneling via Tailscaled (elastic)
• Remote GitHub Actions Runner Registration (elastic)
• AWS SSM Agent Registered via Hybrid Activation (elastic)
• Shell Execution via Elastic Endpoint (elastic)
• First Time Seen RMM Service Hostname from Network DNS (elastic)
• Multiple RMM Vendors Queried by a Single DNS Client (elastic)
• VNC (Virtual Network Computing) from the Internet (elastic)
• VNC (Virtual Network Computing) to the Internet (elastic)
• First Time Seen DNS Query to RMM Domain (elastic)
• Multiple Remote Management Tool Vendors on Same Host (elastic)
• First Time Seen Remote Monitoring and Management Tool (elastic)
• First Time Seen RMM Signer Across the Environment (elastic)
• Newly Observed ScreenConnect Host Server (elastic)
• Quick Assist Full Control Sharing Mode Enabled (elastic)
• Potential REMCOS Trojan Execution (elastic)
• Remote Management Access Launch After MSI Install (elastic)
• NetSupport Manager Execution from an Unusual Path (elastic)
• Potential RMM Execution from a Commonly Abused Web Service (elastic)
• RMM Software Installation from a Commonly Abused Web Service (elastic)
• RMM Software Installation from an Internet-Originated MSI (elastic)
• Suspicious ScreenConnect Client Child Process (elastic)
• Remote File Copy via TeamViewer (elastic)
• Attempt to Establish VScode Remote Tunnel (elastic)
• Suspicious Shell Execution via Velociraptor (elastic)

Showing 25 of 41.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.