detection.wiki

Remote Access Tools T1219

Tactic: Command & Control

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Events covered

19 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 1Process creation
SysmonEvent ID 3Network connection
SysmonEvent ID 7Image loaded
SysmonEvent ID 11FileCreate
SysmonEvent ID 13RegistryEvent (Value Set)
SysmonEvent ID 17PipeEvent (Pipe Created)
SysmonEvent ID 18PipeEvent (Pipe Connected)
SysmonEvent ID 22DNSEvent (DNS query)
Security-AuditingEvent ID 4663An attempt was made to access an object.
Security-AuditingEvent ID 4688A new process has been created.
Security-AuditingEvent ID 4697A service was installed in the system.
Security-AuditingEvent ID 4698A scheduled task was created.
ESFexecProcess Execution
NTLMEvent ID 8001NTLM client blocked audit: Audit outgoing NTLM authentication traffic that would be blocked.
PowerShellEvent ID 4103Payload Context: ContextInfo User Data: UserData.
PowerShellEvent ID 4104Creating Scriptblock text (MessageNumber of MessageTotal).
MsiInstallerEvent ID 1033Windows Installer installed the product.
Service-Control-ManagerEvent ID 7045A service was installed in the system.
Sysmon-for-LinuxEvent ID 1Process Create

Authoring guide

These 111 rules share fields, values, and exclusions.

Fields filtered most (77 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
Image31ends_with 25, contains 7, eq 2, starts_with 2, wildcard 2, in 1, regex_match 1\anydesk.exe, \anydeskmsi.exe, \cmd.exe, \mstsc.exe, \appdata\local\flock\
CommandLine25contains 16, regex_match 7, ends_with 4, is_not_null 1, wildcard 1--meshservicename, --accept-server-license-terms, (?i)(anydesk.exe).*(--silent), (?i)\/i\s.*IntegratorLogin=\S+@(gmail|hotmail|outlook|pro..., (?i)anydesk.exe
EventID22eq 221, 4688, 1033, 22, 4103
process_name20regex_match 8, eq 7, in 3, is_not_null 1, wildcard 1(?i)(simple(help(customer)?|service|gatewayservice)|remot..., (?i)^(teamviewer\.exe|anydesk\.exe|lmiignition\.exe|gotoa..., (?i)^anydesk.exe$, (?i)ateraagent\.exe, (?i)jwrapper-remote\s+(access|support)
event.type16eq 16start, creation, deletion
OriginalFileName12eq 8, contains 2, is_null 2client32.exe, meshagent, mstsc.exe, client??.exe, pcicfgui.exe
TargetFilename11ends_with 6, contains 5, wildcard 1.7z, .bat, .cmd, .dll, .exe
Signature10eq 4, contains 3, in 3, match 1, regex_match 1action1 corporation, aeroadmin llc, amidaware llc, netsupport ltd, APT\d
Company9eq 8, in 1anydesk software gmbh, logmein, inc., amidaware*, ammyy llc*, anydesk software*
Product9eq 8, in 1anydesk, advanced monitoring agent*, ammyy admin*, anydesk*, goto opener
host.os.type9eq 9
Description8eq 7, in 1anydesk, advanced monitoring agent*, ammyy admin*, anydesk*, goto opener
ParentImage8ends_with 5, eq 2, wildcard 1/opt/elastic/endpoint/elastic-endpoint, ?:\programdata\*\client32.exe, ?:\users\*\client32.exe, \action1_agent.exe, \cmd.exe
event.category8eq 6, in 2process, network, network_traffic, file, registry
process.args8eq 5, in 2, contains 1, starts_with 1, wildcard 1--command, -c, -cl, *Reflection.Assembly*, *downloadstring*

Top indicator values (1197 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
141078
EventIDeq
1
8241
EventIDeq
4688
6317
isutilityeq
true
77
CommandLinecontains
--meshservicename
44
CommandLinecontains
--accept-server-license-terms
34
CommandLinecontains
-code
22
CommandLinecontains
-id
22
CommandLinecontains
-region
22
CommandLinecontains
-register
22
CommandLinecontains
.exe tunnel
22
CommandLinecontains
/d /c
22
CommandLinecontains
\servers\stable-
22
CommandLinecontains
code-server.cmd
23
Imageends_with
\anydesk.exe
45
Imageends_with
\anydeskmsi.exe
44
Imageends_with
\cmd.exe
4130
Imageends_with
\mstsc.exe
36
Imageends_with
\powershell.exe
3179
Imageends_with
\pwsh.exe
3165
event.categoryeq
process
4142
CommandLineends_with
.exe tunnel
22
CommandLineends_with
.rdp
22
CommandLineends_with
.rdp"
22
CommandLineregex_match
(?i)(anydesk.exe).*(--silent)
22
CommandLineregex_match
(?i)\/i\s.*IntegratorLogin=\S+@(gmail|hotmail|outlook|protonmail)\.com|(yande...
22
CommandLineregex_match
(?i)anydesk.exe
22
Companyeq
anydesk software gmbh
23
Companyeq
logmein, inc.
22
Descriptioneq
anydesk
23

Exclusions (175 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
rmm_exceptioneq
true
8
rmm_exception_endin
false
8
rmm_exception_endin
unlimited
8
CommandLineregex_match
(?i)(install)
2
Imagecontains
\appdata\local\flock\
2
Imagecontains
\appdata\local\maxthon\
2
Imagecontains
\appdata\local\phoebe\
2
Imagecontains
\appdata\local\programs\midori-ng\
2
Imagecontains
\appdata\local\programs\opera\
2
Imagecontains
\appdata\local\vivaldi\
2
Imagecontains
\tor browser\
2
Imageends_with
\avant.exe
2
Imageends_with
\brave.exe
2
Imageends_with
\falkon.exe
2
Imageends_with
\flock.exe
2

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 52 rules

Elastic 24 rules

Splunk 32 rules

YARA-L 2 rules

Panther 1 rule