ATT&CK · T1219.002 · sub-technique
Remote Desktop Software
Tactics: command-and-control
About
An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment. Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.
Used by actors
11 known groups
Software
1 malware/tools implement this
Corpus indicators tagged with this technique
0 indicators in the corpus carry T1219.002.
No corpus indicators are tagged with this technique yet.