T1219Command and Control
Remote Access Tools
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
6 Sigma rules tagged T1219Remote Access ToolsT12196 general rules
- Renamed Visual Studio Code Tunnel Executionhightest
- Suspicious Velociraptor Child Processhighexperimental
- Visual Studio Code Tunnel Executionmediumtest
- OpenEDR Spawning Command Shellmediumexperimental
- Potentially Suspicious File Creation by OpenEDR's ITSMServicemediumexperimental
- Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Servermediumexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Remote Access Tools
1 CVE, by priority. Each link shows its badge.- CVE-2018-4878Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVRansomwarePublic exploitEnd of lifeHigh · 7.8T1204.002Malicious FileT1219Remote Access Tools+1 more · 1 reportMITRE CTID mapping of the KEV entry · primary impact90.3%Top 0.2%67.3priority