Abused legitimate remote-access tools

Commercial RMM/remote-desktop software installed as a C2 channel

categoryMalwareseverityHighdetectabilityHighlabnot yet measured

Example: AnyDesk, ScreenConnect

Classification

25 values: 15 reviewed, 9 imported, 1 derived. What do these mean?

Exploitability

Attack vector	Malware
Reach (CVSS)	Local
Attack complexity	Low
Privileges required	Low
User interaction	Active
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	ConfidentialityIntegrity
Platform	LinuxmacOSWindows
Environment	CloudOn-premises
Target asset class	EndpointServer
Kill-chain phase (tactic)	Command and Control

Detection & telemetry

Detectability	High
Data sources (ATT&CK data components)	File CreationFirewall Rule ModificationNetwork Connection CreationProcess Creation

Detection & response

Mitigated by 14

M1037 attack-mitigation
M1038 attack-mitigation
M1042 attack-mitigation
D3-APCA d3fend
D3-CSPP d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-OTF d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-RPA d3fend
D3-RTSD d3fend
D3-UGLPA d3fend

Detected by 47

DET0259 attack-detection-strategy
065b00ca-5d5c-4557-ac95-64a6d0b64d86 sigma
0b9ad457-2554-44c1-82c2-d56a99c42377 sigma
101a1877-2cf4-474d-abfd-7f6ac4788d1a sigma
114e7f1c-f137-48c8-8f54-3088c24ce4b9 sigma
145322e4-0fd3-486b-81ca-9addc75736d8 sigma
162ab1e4-6874-4564-853c-53ec3ab8be01 sigma
22c45af6-f590-4d44-bab3-b5b2d2a2b6d9 sigma
238527ad-3c2c-4e4f-a1f6-92fd63adb864 sigma
2d367498-5112-4ae5-a06a-96e7bc33a211 sigma
2fbbe9ff-0afc-470b-bdc0-592198339968 sigma
3ab79e90-9fab-4cdf-a7b2-6522bc742adb sigma
4bb79b62-ef12-4861-981d-2aab43fab642 sigma
4d07b1f4-cb00-4470-b9f8-b0191d48ff52 sigma
52753ea4-b3a0-4365-910d-36cff487b789 sigma
57bff678-25d1-4d6c-8211-8ca106d12053 sigma
5d756aee-ad3e-4306-ad95-cb1abec48de2 sigma
5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af sigma
6e22722b-dfb1-4508-a911-49ac840b40f8 sigma
6f6afac3-8e7a-4e4b-9588-2608ffe08f82 sigma
70761fe8-6aa2-4f80-98c1-a57049c08e66 sigma
74a2b202-73e0-4693-9a3a-9d36146d0775 sigma
758ff488-18d5-4cbe-8ec4-02b6285a434f sigma
778ba9a8-45e4-4b80-8e3e-34a419f0b85e sigma
7b582f1a-b318-4c6a-bf4e-66fe49bf55a5 sigma
87261fb2-69d0-42fe-b9de-88c6b5f65a43 sigma
88656cec-6c3b-487c-82c0-f73ebb805503 sigma
95e60a2b-4705-444b-b7da-ba0ea81a3ee2 sigma
9711de76-5d4f-4c50-a94f-21e4e8f8384d sigma
97233998-3838-4581-88c6-f1d19d3993fb sigma
9847f263-4a81-424f-970c-875dab15b79b sigma
aa3168fb-d594-4f93-a92d-7a9ba675b766 sigma
b1377339-fda6-477a-b455-ac0923f9ec2c sigma
b471f462-eb0d-4832-be35-28d94bdb4780 sigma
b52e84a3-029e-4529-b09b-71d19dd27e94 sigma
b6d98a4f-cef0-4abf-bbf6-24132854a83d sigma
bb09dd3e-2b78-4819-8e35-a7c1b874e449 sigma
bd3b5eaa-439d-4a42-8f35-a49f5c8a2582 sigma
ce5678bb-b9aa-4fb5-be4b-e57f686256ad sigma
d20ee2f4-822c-4827-9e15-41500b1fff10 sigma
… and 7 more in the database

Attack relationships

Parent: Remote access trojan (RAT)
Parent: Tech support scam

Framework references

Primary source: https://attack.mitre.org/techniques/T1219/
attack: T1219.002 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 72 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 15 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)