detection.wiki

Remote Access Tools: Remote Desktop Software T1219.002

Tactic: Command & Control

An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment. Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.

Events covered

11 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 1Process creation
SysmonEvent ID 3Network connection
SysmonEvent ID 7Image loaded
SysmonEvent ID 11FileCreate
SysmonEvent ID 22DNSEvent (DNS query)
Security-AuditingEvent ID 4688A new process has been created.
ESFexecProcess Execution (Notify)
NTLMEvent ID 8001NTLM client blocked audit: Audit outgoing NTLM authentication traffic that would be blocked.
MsiInstallerEvent ID 1033Windows Installer installed the product.
Service-Control-ManagerEvent ID 7045A service was installed in the system.
Sysmon-for-LinuxEvent ID 1Process Create

Authoring guide

Patterns shared across the 50 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (37 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
Image21ends_with 20, contains 6, eq 2, starts_with 2\anydesk.exe, \anydeskmsi.exe, \mstsc.exe, \appdata\local\flock\, \appdata\local\maxthon\
CommandLine12contains 10, ends_with 2, is_not_null 1, wildcard 1--meshservicename, -code , -id , -region , .rdp
TargetFilename9contains 5, ends_with 5.dll, .exe, :\windows\temp\sam.tmp, :\windows\temp\sec.tmp, :\windows\temp\sys.tmp
Company8eq 8AnyDesk Software GmbH, LogMeIn, Inc., DucFabulous Co,ltd, NetSupport Ltd, ScreenConnect Software
Product8eq 8AnyDesk, GoTo Opener, LMIGuardianSvc, NetSupport Remote Control, ScreenConnect
Description7eq 7AnyDesk, GoTo Opener, LMIGuardianSvc, NetSupport Client Configurator, ScreenConnect Service
OriginalFileName7eq 5, contains 2meshagent, mstsc.exe, pcicfgui.exe, ultraviewer_desktop.exe, vncviewer.exe
event.type5eq 5start
process_name5eq 4, is_not_null 1, wildcard 1screenconnect.clientservice.exe, aa_v*.exe, aeroadmin.exe, agentmon.exe, cmd.exe
QueryName4ends_with 2, eq 1, regex_match 1, starts_with 1.rustdesk.com, [a-f0-9]{4,8}\.(?:[a-z0-9\-]+\.){2}[a-z0-9\-]+, agent.jumpcloud.com, agentreporting.atera.com, azurewebsites.net
event.category4eq 4process, network
ParentImage3ends_with 2, eq 1\action1_agent.exe, \cmd.exe, \meshagent.exe, \powershell.exe, c:\windows\system32\lxss\wslhost.exe
Provider_Name3eq 3Service Control Manager, MsiInstaller
parent_process_name3eq 3, wildcard 1AA_v*.exe, AeroAdmin.exe, AgentMon.exe, explorer.exe, sihost.exe
Esql.count_distinct_host_id2eq 21

Top indicator values (742 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
5606
CommandLinecontains
--meshservicename
44
CommandLinecontains
-code
22
CommandLinecontains
-id
22
CommandLinecontains
-region
22
CommandLinecontains
-register
22
Imageends_with
\anydesk.exe
45
Imageends_with
\anydeskmsi.exe
44
Imageends_with
\mstsc.exe
36
Imageends_with
\avant.exe
2
Imageends_with
\brave.exe
211
Imageends_with
\cmd.exe
2130
Imageends_with
\falkon.exe
2
Imageends_with
\flock.exe
2
event.categoryeq
process
3128
process_nameeq
screenconnect.clientservice.exe
33
CommandLineends_with
.rdp
22
CommandLineends_with
.rdp"
22
Companyeq
AnyDesk Software GmbH
23
Companyeq
LogMeIn, Inc.
22
Descriptioneq
AnyDesk
23
Esql.count_distinct_host_ideq
1
22
Esql.recentle
6
26
Imagecontains
\appdata\local\flock\
2
Imagecontains
\appdata\local\maxthon\
2
Imagecontains
\appdata\local\phoebe\
2
Imagecontains
\appdata\local\programs\midori-ng\
2
Imagecontains
\appdata\local\programs\opera\
2
Imagecontains
\appdata\local\vivaldi\
2
Imagecontains
\tor browser\
2

Exclusions (89 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
Imagecontains
\appdata\local\flock\
2
Imagecontains
\appdata\local\maxthon\
2
Imagecontains
\appdata\local\phoebe\
2
Imagecontains
\appdata\local\programs\midori-ng\
2
Imagecontains
\appdata\local\programs\opera\
2
Imagecontains
\appdata\local\vivaldi\
2
Imagecontains
\tor browser\
2
Imageends_with
\avant.exe
2
Imageends_with
\brave.exe
2
Imageends_with
\falkon.exe
2
Imageends_with
\flock.exe
2
Imageends_with
\maxthon.exe
2
Imageends_with
\midori next generation.exe
2
Imageends_with
\msedge.exe
2
Imageends_with
\msedgewebview2.exe
2

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 44 rules

Elastic 6 rules