Detection rules › Splunk
Remote Access Software Execution (Sysmon)
Remote access tools are commonly used as legitimate technical support software and may be allowed by application control within a target environment. Adversaries may install and use these tools post-compromise as alternate communications channels for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system. Installation of many remote access tools may also include persistence (ex: the tool's installation routine creates a Windows Service). This use case detects the execution of remote access software known to be used by threat actors
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
id: '13705.20073'
title: Remote Access Software Execution
description: 'Remote access tools are commonly used as legitimate technical support
software and may be allowed by application control within a target environment.
Adversaries may install and use these tools post-compromise as alternate communications
channels for redundant access or as a way to establish an interactive remote desktop
session with the target system. They may also be used as a component of malware
to establish a reverse connection or back-connect to a service or adversary controlled
system. Installation of many remote access tools may also include persistence (ex:
the tool''s installation routine creates a Windows Service). This use case detects
the execution of remote access software known to be used by threat actors. - Threat
Actor Association: Andariel, APT43, FIN7, Muddled Libra, Scattered Spider (aka.
0ktapus, UNC3944), Scatter Swine - Software Association: ALPHV/BlackCat, AvosLocker,
BianLian, Black Basta, Clop, Hive, LockBit, Royal, Trigona - Atomics T1219 Test
#1 Atomics T1219 Test #2 Atomics T1219 Test #3 Atomics T1219 Test #4 Atomics T1219
Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
("TeamViewer.exe" OR "AnyDesk.exe" OR "LMIIgnition.exe" OR "GoToAssist.exe" OR "ScreenConnect.exe"
OR "ammyy.exe" OR "RemotePC.exe" OR "NetSupport.exe" OR "UltraViewer_Desktop.exe"
OR "vncviewer.exe" OR "Splashtop.exe" OR "Supremo.exe" OR "PCICTLUI.exe" OR "QuickAssist.exe") | where
match(process_name, "(?i)^(TeamViewer\.exe|AnyDesk\.exe|LMIIgnition\.exe|GoToAssist\.exe|ScreenConnect\.exe|ammyy\.exe|RemotePC\.exe|NetSupport\.exe|UltraViewer_Desktop\.exe|vncviewer\.exe|Splashtop\.exe|Supremo\.exe|PCICTLUI\.exe|QuickAssist\.exe)$")|
table _time, host, user process, process_*, signature_id, parent_* | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- command-and-control:remote access software
technique_id:
- T1219
data_category:
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1219/T1219.md
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") ("TeamViewer.exe" OR "AnyDesk.exe" OR "LMIIgnition.exe" OR "GoToAssist.exe" OR "ScreenConnect.exe" OR "ammyy.exe" OR "RemotePC.exe" OR "NetSupport.exe" OR "UltraViewer_Desktop.exe" OR "vncviewer.exe" OR "Splashtop.exe" OR "Supremo.exe" OR "PCICTLUI.exe" OR "QuickAssist.exe")
Stage 2: where
| where match(process_name, "(?i)^(TeamViewer\.exe|AnyDesk\.exe|LMIIgnition\.exe|GoToAssist\.exe|ScreenConnect\.exe|ammyy\.exe|RemotePC\.exe|NetSupport\.exe|UltraViewer_Desktop\.exe|vncviewer\.exe|Splashtop\.exe|Supremo\.exe|PCICTLUI\.exe|QuickAssist\.exe)$")
Stage 3: table
| table _time, host, user process, process_*, signature_id, parent_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"1" |
process_name | regex_match |
| field:"process_name" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>1<" |
| 1 | "TeamViewer.exe" |
| 1 | "AnyDesk.exe" |
| 1 | "LMIIgnition.exe" |
| 1 | "GoToAssist.exe" |
| 1 | "ScreenConnect.exe" |
| 1 | "ammyy.exe" |
| 1 | "RemotePC.exe" |
| 1 | "NetSupport.exe" |
| 1 | "UltraViewer_Desktop.exe" |
| 1 | "vncviewer.exe" |
| 1 | "Splashtop.exe" |
| 1 | "Supremo.exe" |
| 1 | "PCICTLUI.exe" |
| 1 | "QuickAssist.exe" |