Techniques › T1219
T1219 Remote Access Tools
command and control — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
6
Sigma rules tagged attack.t1219
1
KEV CVEs mapped here
<p>An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.</p><p>Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system.</p><p>Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a Windows Service). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2018-4878 | Adobe Flash Player | primary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0496 Behavior-Chain Detection for Remote Access Tools (Tool-Agnostic) v1.0
AN1366 WindowsChain of remote access tool behavior: (1) initial execution of remote-control/assist agent or GUI under user context; (2) persistence via service or autorun; (3) long-lived outbound connection/tunnel to external infrastructure; (4) interactive control signals such as shell or file-manager child processes spawned by the RAT parent.Tunable:
TimeWindowUserContextProcessAllowlistInstallPathRegexExternalIPAllowlistShellSpawnRegexEgressHeuristicsAN1367 LinuxSequence of RAT agent execution, systemd persistence, and long-lived external egress; optional interactive shells spawned from the agent.auditd:SYSCALLexecve: Agent/headless flags (listen/connect/reverse/tunnel) or remote-control binaries spawning shells→ DC0032 Process Creationauditd:PATHWRITE: Drop of binaries/scripts in ~/.local, /tmp, or /opt tool dirs→ DC0039 File CreationTunable:TimeWindowDaemonAllowlistSuspiciousChildProcessesEgressHeuristicsAN1368 macOSElectron/GUI or headless RAT execution followed by LaunchAgent/Daemon persistence and persistent external connections; interactive children (osascript/sh/curl) spawned by parent.macos:unifiedlogProcess exec of remote-control apps or binaries with headless/connect flags→ DC0032 Process Creationmacos:osqueryCREATE/MODIFY: Creation of LaunchAgents/Daemons plists in user/system locations→ DC0039 File Creationmacos:osqueryCONNECT: Long-lived connections from remote-control parents to external IPs/domains→ DC0082 Network Connection CreationTunable:AllowedAppBundlePathsLaunchdAllowlistTimeWindowEgressHeuristics
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1219
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-09-28 (modified 2025-10-29) · logsource: product=windows category=process_creation · 2cf29f11-e356-4f61-98c0-1bdb9393d6da
Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server
mediumexperimental
Author: Ahmed Nosir (@egycondor)
· 2025-05-29 · logsource: product=windows category=process_creation · 2db93a3f-3249-4f73-9e68-0e77a0f8ae7e
Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line.
These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID.
This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-08-29 · logsource: product=windows category=process_creation · 4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c
Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.
Author: @kostastsale
· 2026-02-19 · logsource: product=windows category=process_creation · 7f3a9c2d-4e8b-4a7f-9d3e-5c6f8a9b2e1d
Detects the OpenEDR ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY (pseudo-terminal) capabilities.
This may indicate remote command execution through OpenEDR's remote management features, which could be legitimate administrative activity or potential abuse of the remote access tool.
Threat actors may leverage OpenEDR's remote shell capabilities to execute commands on compromised systems, facilitating lateral movement or other command-and-control operations.
Author: Nasreddine Bencherchali (Nextron Systems), citron_ninja
· 2023-10-25 (modified 2025-10-29) · logsource: product=windows category=process_creation · 90d6bd71-dffb-4989-8d86-a827fedd6624
Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
Author: @kostastsale
· 2026-02-19 · logsource: product=windows category=file_event · 9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d
Detects the creation of potentially suspicious files by OpenEDR's ITSMService process.
The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features.
While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.