CmdID / Techniques / T1219
T1219.002 Remote Access Tools: Remote Desktop Software
An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. MITRE ATT&CK
24 Sigma rules T1219.002 on attack.mitre.org
Part of
T1219Remote Access Tools
Sigma rules tagged with it
highRemote Access Tool - Anydesk Execution From Suspicious FolderFlorian Roth (Nextron Systems) · Windows
highRemote Access Tool - Renamed MeshAgent Execution - WindowsNorbert Jaśniewicz (AlphaSOC) · Windows
highSuspicious Mstsc.EXE Execution With Local RDP FileNasreddine Bencherchali (Nextron Systems) · Windows
mediumRemote Access Tool - Action1 Arbitrary Code Execution and Remote Sessions@kostastsale · Windows
mediumRemote Access Tool - AnyDesk Piped Password Via CLINasreddine Bencherchali (Nextron Systems) · Windows
mediumRemote Access Tool - Potential MeshAgent Execution - MacOSNorbert Jaśniewicz (AlphaSOC) · macOS
mediumRemote Access Tool - Potential MeshAgent Execution - WindowsNorbert Jaśniewicz (AlphaSOC) · Windows
mediumRemote Access Tool - ScreenConnect Potential Suspicious Remote Command ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale · Windows
lowMstsc.EXE Execution With Local RDP FileNasreddine Bencherchali (Nextron Systems), Christopher Peacock @securepeacock · Windows