{"id":"T1219","name":"Remote Access Tools","url":"https://attack.mitre.org/techniques/T1219","tactics":["command-and-control"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0496","stix_id":"x-mitre-detection-strategy--ec412019-109f-4f84-aa2f-d623f40254e0","name":"Behavior-Chain Detection for Remote Access Tools (Tool-Agnostic)","url":"https://attack.mitre.org/detectionstrategies/DET0496","analytics":[{"id":"AN1366","stix_id":"x-mitre-analytic--ba2056ee-77d7-49d4-a993-5806506964df","name":"Analytic 1366","description":"Chain of remote access tool behavior: (1) initial execution of remote-control/assist agent or GUI under user context; (2) persistence via service or autorun; (3) long-lived outbound connection/tunnel to external infrastructure; (4) interactive control signals such as shell or file-manager child processes spawned by the RAT parent.","url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1366","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:System","channel":"EventCode=7045","data_component":"DC0060","data_component_name":"Service Creation","log_source_slug":"wineventlog-system"},{"name":"WinEventLog:Sysmon","channel":"EventCode=12","data_component":"DC0056","data_component_name":"Windows Registry Key Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlation period binding start→persistence→egress→child (default 15m, adjust per environment)."},{"field":"UserContext","description":"Differentiate help-desk/jump hosts and admin accounts from standard endpoints."},{"field":"ProcessAllowlist","description":"Known-good remote support tools; suppress expected events while still correlating anomalous sequences."},{"field":"InstallPathRegex","description":"Alert when services/agents execute from user-writable or temp paths."},{"field":"ExternalIPAllowlist","description":"Vendors’ support clouds/CDNs to reduce false positives on egress detection."},{"field":"ShellSpawnRegex","description":"Define which child shells from GUI parents are acceptable versus suspicious."},{"field":"EgressHeuristics","description":"Thresholds for session duration, connection counts, and bytes_out/bytes_in ratio."}],"live":true,"detection_strategies":["DET0496"],"techniques":["T1219"]},{"id":"AN1367","stix_id":"x-mitre-analytic--d90a4f16-b5e1-4daa-bf65-91112fe02761","name":"Analytic 1367","description":"Sequence of RAT agent execution, systemd persistence, and long-lived external egress; optional interactive shells spawned from the agent.","url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1367","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve: Agent/headless flags (listen/connect/reverse/tunnel) or remote-control binaries spawning shells","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:PATH","channel":"WRITE: Drop of binaries/scripts in ~/.local, /tmp, or /opt tool dirs","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"auditd-path"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Bind exec→service→egress events; extend for staged deployments."},{"field":"DaemonAllowlist","description":"Approved .service names/paths to avoid flagging corporate agents."},{"field":"SuspiciousChildProcesses","description":"Define shells/interpreters considered anomalous when spawned by GUI/agent parents."},{"field":"EgressHeuristics","description":"Flow heuristics for long-lived, client-heavy connections post-install."}],"live":true,"detection_strategies":["DET0496"],"techniques":["T1219"]},{"id":"AN1368","stix_id":"x-mitre-analytic--97f27df6-5041-437b-9aeb-58a9bc33a376","name":"Analytic 1368","description":"Electron/GUI or headless RAT execution followed by LaunchAgent/Daemon persistence and persistent external connections; interactive children (osascript/sh/curl) spawned by parent.","url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1368","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Process exec of remote-control apps or binaries with headless/connect flags","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"CREATE/MODIFY: Creation of LaunchAgents/Daemons plists in user/system locations","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"macos-osquery"},{"name":"macos:osquery","channel":"CONNECT: Long-lived connections from remote-control parents to external IPs/domains","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"AllowedAppBundlePaths","description":"Legitimate remote-support apps under /Applications."},{"field":"LaunchdAllowlist","description":"Known-good LaunchAgents/Daemons identifiers."},{"field":"TimeWindow","description":"Window for correlating exec→launchd→egress events."},{"field":"EgressHeuristics","description":"Duration/volume thresholds for persistent sessions."}],"live":true,"detection_strategies":["DET0496"],"techniques":["T1219"]}],"live":true,"version":"1.0","techniques":["T1219"]}],"sigma_rules":[{"id":"2cf29f11-e356-4f61-98c0-1bdb9393d6da","title":"Renamed Visual Studio Code Tunnel Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-09-28","modified":"2025-10-29","description":"Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel","references":["https://ipfyx.fr/post/visual-studio-code-tunnel/","https://badoption.eu/blog/2023/01/31/code_c2.html","https://code.visualstudio.com/docs/remote/tunnels"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.t1071.001","attack.t1219"],"path":"rules/windows/process_creation/proc_creation_win_vscode_tunnel_renamed_execution.yml","techniques":["T1071.001","T1219"],"cves":[]},{"id":"2db93a3f-3249-4f73-9e68-0e77a0f8ae7e","title":"Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server","author":"Ahmed Nosir (@egycondor)","status":"experimental","level":"medium","date":"2025-05-29","modified":null,"description":"Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line.\nThese parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID.\nThis technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.\n","references":["https://github.com/amidaware/tacticalrmm","https://apophis133.medium.com/powershell-script-tactical-rmm-installation-45afb639eff3"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.t1219","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_remote_access_tools_tacticalrmm_agent_registration_via_cli.yml","techniques":["T1219","T1105"],"cves":[]},{"id":"4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c","title":"Suspicious Velociraptor Child Process","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-08-29","modified":null,"description":"Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.","references":["https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.persistence","attack.t1219"],"path":"rules/windows/process_creation/proc_creation_win_susp_velociraptor_child_process.yml","techniques":["T1219"],"cves":[]},{"id":"7f3a9c2d-4e8b-4a7f-9d3e-5c6f8a9b2e1d","title":"OpenEDR Spawning Command Shell","author":"@kostastsale","status":"experimental","level":"medium","date":"2026-02-19","modified":null,"description":"Detects the OpenEDR ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY (pseudo-terminal) capabilities.\nThis may indicate remote command execution through OpenEDR's remote management features, which could be legitimate administrative activity or potential abuse of the remote access tool.\nThreat actors may leverage OpenEDR's remote shell capabilities to execute commands on compromised systems, facilitating lateral movement or other command-and-control operations.\n","references":["https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.003","attack.lateral-movement","attack.t1021.004","attack.command-and-control","attack.t1219"],"path":"rules/windows/process_creation/proc_creation_win_comodo_ssh_shellhost_cmd_spawn.yml","techniques":["T1059.003","T1021.004","T1219"],"cves":[]},{"id":"90d6bd71-dffb-4989-8d86-a827fedd6624","title":"Visual Studio Code Tunnel Execution","author":"Nasreddine Bencherchali (Nextron Systems), citron_ninja","status":"test","level":"medium","date":"2023-10-25","modified":"2025-10-29","description":"Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel","references":["https://ipfyx.fr/post/visual-studio-code-tunnel/","https://badoption.eu/blog/2023/01/31/code_c2.html","https://code.visualstudio.com/docs/remote/tunnels"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.t1071.001","attack.t1219"],"path":"rules/windows/process_creation/proc_creation_win_vscode_tunnel_execution.yml","techniques":["T1071.001","T1219"],"cves":[]},{"id":"9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d","title":"Potentially Suspicious File Creation by OpenEDR's ITSMService","author":"@kostastsale","status":"experimental","level":"medium","date":"2026-02-19","modified":null,"description":"Detects the creation of potentially suspicious files by OpenEDR's ITSMService process.\nThe ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features.\nWhile legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.\n","references":["https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.command-and-control","attack.t1105","attack.lateral-movement","attack.t1570","attack.t1219"],"path":"rules/windows/file/file_event/file_event_win_comodo_itsm_potentially_suspicious_file_creation.yml","techniques":["T1105","T1570","T1219"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2018-4878","state":"mapped","mapping_types":["primary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}