detection.wiki

Remote Access Tools T1219

Tactic: Command & Control

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Events covered

19 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 1Process creation
SysmonEvent ID 3Network connection
SysmonEvent ID 7Image loaded
SysmonEvent ID 11FileCreate
SysmonEvent ID 13RegistryEvent (Value Set)
SysmonEvent ID 17PipeEvent (Pipe Created)
SysmonEvent ID 18PipeEvent (Pipe Connected)
SysmonEvent ID 22DNSEvent (DNS query)
Security-AuditingEvent ID 4663An attempt was made to access an object.
Security-AuditingEvent ID 4688A new process has been created.
Security-AuditingEvent ID 4697A service was installed in the system.
Security-AuditingEvent ID 4698A scheduled task was created.
ESFexecProcess Execution
NTLMEvent ID 8001NTLM client blocked audit: Audit outgoing NTLM authentication traffic that would be blocked.
PowerShellEvent ID 4103Payload Context: ContextInfo User Data: UserData.
PowerShellEvent ID 4104Creating Scriptblock text (MessageNumber of MessageTotal).
MsiInstallerEvent ID 1033Windows Installer installed the product.
Service-Control-ManagerEvent ID 7045A service was installed in the system.
Sysmon-for-LinuxEvent ID 1Process Create

Authoring guide

These 111 rules share fields, values, and exclusions.

Fields filtered most (73 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
Image31ends_with 25, contains 7, eq 2, starts_with 2, wildcard 2, in 1, regex_match 1\AnyDesk.exe, \cmd.exe, \AnyDeskMSI.exe, \mstsc.exe, C:\Program Files (x86)\Avant Browser\
CommandLine25contains 16, regex_match 7, ends_with 4, is_not_null 1, wildcard 1--meshServiceName, --accept-server-license-terms, (?i)(anydesk.exe).*(--silent), (?i)\/i\s.*IntegratorLogin=\S+@(gmail|hotmail|outlook|pro..., (?i)anydesk.exe
EventID22eq 221, 4688, 1033, 22, 4103
event.type16eq 16start, creation, deletion
OriginalFileName12eq 8, contains 2, is_null 2, client32.exe, meshagent, mstsc.exe, PCICFGUI.EXE
process_basename12eq 7, in 3, is_not_null 1, wildcard 1ScreenConnect.ClientService.exe, bash, csh, dash,
TargetFilename11ends_with 6, contains 5, wildcard 1.7z, .bat, .cmd, .dll, .exe
Signature10eq 4, contains 3, in 3, match 1, regex_match 1AOMEI International Network Limited, AWERAY PTE. LTD., Action1 Corporation, NetSupport Ltd, AMRat
Company9eq 8, in 1AnyDesk Software GmbH, LogMeIn, Inc., ATERA Networks*, AmidaWare*, Ammyy LLC*
Product9eq 8, in 1AnyDesk, Advanced Monitoring Agent*, Ammyy Admin*, AnyDesk*, GoTo Opener
Description8eq 7, in 1AnyDesk, Advanced Monitoring Agent*, Ammyy Admin*, AnyDesk*, GoTo Opener
ParentImage8ends_with 5, eq 2, wildcard 1/opt/Elastic/Endpoint/elastic-endpoint, ?:\ProgramData\*\client32.exe, ?:\Users\*\client32.exe, C:\Windows\System32\lxss\wslhost.exe, \ITSMService.exe
event.category8eq 6, in 2process, network, network_traffic, file, registry
process.args8eq 5, in 2, contains 1, starts_with 1, wildcard 1--command, -c, -cl, *--outbound-http-proxy-listen*, *--socks5-server*
process_name8regex_match 8(?i)(Simple(help(customer)?|service|gatewayservice)|remot..., (?i)AteraAgent\.exe, (?i)JWrapper-Remote\s+(Access|Support), (?i)Simple(help(customer)?|service|gatewayservice)\.exe, (?i)^(TeamViewer\.exe|AnyDesk\.exe|LMIIgnition\.exe|GoToA...

Top indicator values (1210 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
121036
EventIDeq
1
8226
EventIDeq
4688
6284
isutilityeq
TRUE
77
CommandLinecontains
--meshServiceName
44
CommandLinecontains
--accept-server-license-terms
33
CommandLinecontains
-code
22
CommandLinecontains
-id
22
CommandLinecontains
-region
22
CommandLinecontains
-register
22
CommandLinecontains
.exe tunnel
22
CommandLinecontains
/d /c
22
CommandLinecontains
\servers\Stable-
22
CommandLinecontains
code-server.cmd
22
Imageends_with
\AnyDesk.exe
45
Imageends_with
\AnyDeskMSI.exe
44
Imageends_with
\cmd.exe
4132
Imageends_with
\mstsc.exe
36
Imageends_with
\powershell.exe
3181
Imageends_with
\pwsh.exe
3166
CommandLineends_with
.exe tunnel
22
CommandLineends_with
.rdp
22
CommandLineends_with
.rdp"
22
CommandLineregex_match
(?i)(anydesk.exe).*(--silent)
22
CommandLineregex_match
(?i)\/i\s.*IntegratorLogin=\S+@(gmail|hotmail|outlook|protonmail)\.com|(yande...
22
CommandLineregex_match
(?i)anydesk.exe
22
Companyeq
AnyDesk Software GmbH
23
Companyeq
LogMeIn, Inc.
22
Descriptioneq
AnyDesk
23
DestinationPortge
5800
22

Exclusions (175 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
rmm_exceptioneq
TRUE
8
rmm_exception_endin
FALSE
8
rmm_exception_endin
UNLIMITED
8
CommandLineregex_match
(?i)(install)
2
Imagecontains
\AppData\Local\Flock\
2
Imagecontains
\AppData\Local\Maxthon\
2
Imagecontains
\AppData\Local\Phoebe\
2
Imagecontains
\AppData\Local\Programs\Opera\
2
Imagecontains
\AppData\Local\Programs\midori-ng\
2
Imagecontains
\AppData\Local\Vivaldi\
2
Imagecontains
\Tor Browser\
2
Imageends_with
\Flock.exe
2
Imageends_with
\avant.exe
2
Imageends_with
\brave.exe
2
Imageends_with
\falkon.exe
2

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 52 rules

Elastic 24 rules

Splunk 32 rules

YARA-L 2 rules

Panther 1 rule