Tech support scam

Fake technician gains remote access, "finds" viruses and demands untraceable payment

Classification

28 values: 13 imported, 2 derived, 13 machine-classified. What do these mean?

Exploitability

Impact & scope

Detection & telemetry

Detection & response

Mitigated by 16

• M1031 attack-mitigation
• M1034 attack-mitigation
• M1037 attack-mitigation
• M1038 attack-mitigation
• M1042 attack-mitigation
• D3-APCA d3fend
• D3-CSPP d3fend
• D3-NTCD d3fend
• D3-NTF d3fend
• D3-NTSA d3fend
• D3-OTF d3fend
• D3-PHDURA d3fend
• D3-PMAD d3fend
• D3-RPA d3fend
• D3-RTSD d3fend
• D3-UGLPA d3fend

Detected by 53

• DET0496 attack-detection-strategy
• 065b00ca-5d5c-4557-ac95-64a6d0b64d86 sigma
• 0b9ad457-2554-44c1-82c2-d56a99c42377 sigma
• 101a1877-2cf4-474d-abfd-7f6ac4788d1a sigma
• 114e7f1c-f137-48c8-8f54-3088c24ce4b9 sigma
• 145322e4-0fd3-486b-81ca-9addc75736d8 sigma
• 162ab1e4-6874-4564-853c-53ec3ab8be01 sigma
• 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9 sigma
• 238527ad-3c2c-4e4f-a1f6-92fd63adb864 sigma
• 2cf29f11-e356-4f61-98c0-1bdb9393d6da sigma
• 2d367498-5112-4ae5-a06a-96e7bc33a211 sigma
• 2db93a3f-3249-4f73-9e68-0e77a0f8ae7e sigma
• 2fbbe9ff-0afc-470b-bdc0-592198339968 sigma
• 3ab79e90-9fab-4cdf-a7b2-6522bc742adb sigma
• 4bb79b62-ef12-4861-981d-2aab43fab642 sigma
• 4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c sigma
• 4d07b1f4-cb00-4470-b9f8-b0191d48ff52 sigma
• 52753ea4-b3a0-4365-910d-36cff487b789 sigma
• 57bff678-25d1-4d6c-8211-8ca106d12053 sigma
• 5d756aee-ad3e-4306-ad95-cb1abec48de2 sigma
• 5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af sigma
• 6e22722b-dfb1-4508-a911-49ac840b40f8 sigma
• 6f6afac3-8e7a-4e4b-9588-2608ffe08f82 sigma
• 70761fe8-6aa2-4f80-98c1-a57049c08e66 sigma
• 74a2b202-73e0-4693-9a3a-9d36146d0775 sigma
• 758ff488-18d5-4cbe-8ec4-02b6285a434f sigma
• 778ba9a8-45e4-4b80-8e3e-34a419f0b85e sigma
• 7b582f1a-b318-4c6a-bf4e-66fe49bf55a5 sigma
• 7f3a9c2d-4e8b-4a7f-9d3e-5c6f8a9b2e1d sigma
• 87261fb2-69d0-42fe-b9de-88c6b5f65a43 sigma
• 88656cec-6c3b-487c-82c0-f73ebb805503 sigma
• 90d6bd71-dffb-4989-8d86-a827fedd6624 sigma
• 95e60a2b-4705-444b-b7da-ba0ea81a3ee2 sigma
• 9711de76-5d4f-4c50-a94f-21e4e8f8384d sigma
• 97233998-3838-4581-88c6-f1d19d3993fb sigma
• 9847f263-4a81-424f-970c-875dab15b79b sigma
• 9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d sigma
• aa3168fb-d594-4f93-a92d-7a9ba675b766 sigma
• b1377339-fda6-477a-b455-ac0923f9ec2c sigma
• b471f462-eb0d-4832-be35-28d94bdb4780 sigma
• … and 13 more in the database

Tested by 15

• 0ae9e327-3251-465a-a53b-485d4e3f58fa atomic
• 19acf63b-55c4-4b6a-8552-00a8865105c8 atomic
• 1aea6d15-70f1-4b4e-8b02-397b5d5ffe75 atomic
• 1b72b3bd-72f8-4b63-a30b-84e91b9c3578 atomic
• 3e1858ee-3550-401c-86ec-5e70ed79295b atomic
• 42e51815-a6cc-4c75-b970-3f0ff54b610e atomic
• 4a18cc4e-416f-4966-9a9d-75731c4684c0 atomic
• 6b8b7391-5c0a-4f8c-baee-78d8ce0ce330 atomic
• 8ca3b96d-8983-4a7f-b125-fc98cc0a2aa0 atomic
• b025c580-029e-4023-888d-a42710d76934 atomic
• b1b8128b-c5d4-4de9-bf70-e60419274562 atomic
• d03683ec-aae0-42f9-9b4c-534780e0f8e1 atomic
• ecca999b-e0c8-40e8-8416-ad320b146a75 atomic
• f1641ba9-919a-4323-b74f-33372333bf0e atomic
• fbff3f1f-b0bf-448e-840f-7e1687affdce atomic

Attack relationships

• Child: Abused legitimate remote-access tools

Framework references

• Primary source: https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams
• capec: CAPEC-413 (primary)
• attack: T1219

Evidence & sources

• ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Social engineering and human-targeted attacks' table, line 45 of Cyber-Attack-Taxonomy.md
• ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to capec:CAPEC-413, attack:T1219 as the nearest framework entries; ids verified to exist in the cached catalogues.
• ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 22 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)