CmdID

CmdID / Techniques

T1219 Remote Access Tools

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. MITRE ATT&CK

5 Sigma rules T1219 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1219.002Remote Access Tools: Remote Desktop Software

Sigma rules tagged with it

process creation, the highest levels first

highRenamed Visual Studio Code Tunnel ExecutionNasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious Velociraptor Child ProcessSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumOpenEDR Spawning Command Shell@kostastsale · Windows

mediumRemote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled ServerAhmed Nosir (@egycondor) · Windows

mediumVisual Studio Code Tunnel ExecutionNasreddine Bencherchali (Nextron Systems), citron_ninja · Windows