T1219 Remote Access Tools
EnterpriseAn adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access. Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system. Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a Windows Service). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-techniques (3)
More specific entries beneath this one.
mitigations
ATT&CK mitigations that reduce this.
detected by (6)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
Detect
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.DSData Securitystrong · backed by 7 of 13 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 6 of 13 mapped controls
- PR.PSPlatform Securitymoderate · backed by 4 of 13 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (13)
Security controls that mitigate this.
known-exploited CVEs (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-4878US | high7.8OT critical | KEV | ||
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media pla… | ||||
groups (13)
Threat groups associated with this.
software (7)
Malware and tools associated with this.
campaigns (2)
Campaigns that use this.
Detected by (Sigma) (6)
Sigma detection rules related to this.
source
Where this definition is published.