Remote Access Tools: Remote Desktop Software

ID: T1219.002
Tactics: TA0011 Command and Control
Sub-technique of: T1219 Remote Access Tools
Platforms: Linux, macOS, Windows
Data sources: File Creation, Network Connection Creation, Firewall Rule Modification, Process Creation
Source: attack.mitre.org
MITRE last modified: 12 May 2026

An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as VNC, Team Viewer, AnyDesk, ScreenConnect, LogMein, AmmyyAdmin, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.^[1]^[2]^[3]

Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.^[4]^[5]

Detection

DET0259 Remote Desktop Software Execution and Beaconing Detection
Data components: File Creation, Network Connection Creation, Firewall Rule Modification, Process Creation

Mitigations (3)

M1037 Filter Network Traffic: Properly configure firewalls, application firewalls, and proxies to limit outgoing traffic to sites and services used by remote access software.
M1038 Execution Prevention: Use application control to mitigate installation and use of unapproved software that can be used for remote access.
M1042 Disable or Remove Feature or Program: Consider disabling unnecessary remote connection functionality, including both unapproved software installations and specific features built into supported applications.

Groups (12)

Software (1)

S1242 Qilin