An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as VNC, Team Viewer, AnyDesk, ScreenConnect, LogMein, AmmyyAdmin, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.[1][2][3]
Remote access software may be installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary-controlled system.
Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
Installation of many remote access software may also include persistence (e.g., the software's installation routine creates a Windows Service). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).[4][5]
| 效应类型 | 是否存在 |
|---|---|
| 特征伪装 | ✅ |
| 行为透明 | ❌ |
| 数据遮蔽 | ✅ |
| 时空释痕 | ✅ |
攻击者通过多重手段实现远程访问流量特征伪装，包括：滥用数字签名合法的远程工具进程、动态修改协议栈指纹匹配企业应用特征、将控制流量嵌套封装在标准协议隧道内。这使得恶意会话在进程树、网络协议、证书链等维度均呈现合法特征，规避基于特征匹配的检测规则。
采用多层加密机制保护通信内容，包括TLS 1.3加密传输、内存模块运行时加密、隧道载荷端到端加密等，确保防御方即使截获流量也无法解析有效攻击信息。云端节点间的通信还可利用云服务商提供的原生加密通道（如AWS VPC流量加密）增强隐蔽性。
通过云节点动态创建/销毁机制实现控制链路的分钟级切换，结合全球分布式节点池的地理分散特性，使得单个攻击会话的持续时间、通信频率、源IP分布等时空特征均低于检测阈值，传统基于时间窗口的关联分析难以奏效。
| ID | Name | Description |
|---|---|---|
| G1024 | Akira |
Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.[6][7] |
| C0015 | C0015 |
During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network.[8] |
| C0018 | C0018 |
During C0018, the threat actors used AnyDesk to transfer tools between systems.[9][10] |
| C0027 | C0027 |
During C0027, Scattered Spider directed victims to run remote monitoring and management (RMM) tools.[11] |
| S0030 | Carbanak | |
| G0008 | Carbanak |
Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.[13] |
| G0080 | Cobalt Group |
Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.[14][15][16] |
| G0105 | DarkVishnya |
DarkVishnya used DameWare Mini Remote Control for lateral movement.[17] |
| S0384 | Dridex | |
| S0554 | Egregor |
Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines.[19] |
| G0120 | Evilnum |
EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromrised machines.[20] |
| G0046 | FIN7 |
FIN7 has utilized the remote management tool Atera to download malware to a compromised system.[21] |
| G0115 | GOLD SOUTHFIELD |
GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool "ConnectWise Control" to deploy REvil.[22] |
| S0601 | Hildegard |
Hildegard has established tmate sessions for C2 communications.[23] |
| G1032 | INC Ransom |
INC Ransom has used AnyDesk and PuTTY on compromised systems.[24][25][26][27] |
| G0094 | Kimsuky |
Kimsuky has used a modified TeamViewer client as a command and control channel.[28][29] |
| G0069 | MuddyWater |
MuddyWater has used legitimate applications ScreenConnect, AteraAgent and SimpleHelp to manage systems remotely and move laterally.[30][31][32][33] |
| G0129 | Mustang Panda |
Mustang Panda has installed TeamViewer on targeted systems.[34] |
| C0002 | Night Dragon |
During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels.[35] |
| S0148 | RTM |
RTM has the capability to download a VNC module from command and control (C2).[36] |
| G0048 | RTM |
RTM has used a modified version of TeamViewer and Remote Utilities for remote access.[37] |
| G0034 | Sandworm Team |
Sandworm Team has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.[38][39] |
| G1015 | Scattered Spider |
During C0027, Scattered Spider directed victims to run remote monitoring and management (RMM) tools.[11] In addition to directing victims to run remote software, Scattered Spider members themselves also deploy RMM software including AnyDesk, LogMeIn, and ConnectWise Control to establish persistence on the compromised network.[40][41] |
| G0139 | TeamTNT |
TeamTNT has established tmate sessions for C2 communications.[23][42] |
| G0076 | Thrip |
Thrip used a cloud-based remote access software called LogMeIn for their attacks.[43] |
| S0266 | TrickBot |
TrickBot uses vncDll module to remote control the victim machine.[44][45] |
| ID | Mitigation | Description |
|---|---|---|
| M1042 | Disable or Remove Feature or Program |
Consider disabling unnecessary remote connection functionality, including both unapproved software installations and specific features built into supported applications. |
| M1038 | Execution Prevention |
Use application control to mitigate installation and use of unapproved software that can be used for remote access. |
| M1037 | Filter Network Traffic |
Properly configure firewalls, application firewalls, and proxies to limit outgoing traffic to sites and services used by remote access software. |
| M1031 | Network Intrusion Prevention |
Network intrusion detection and prevention systems that use network signatures may be able to prevent traffic to remote access services. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0029 | Network Traffic | Network Connection Creation |
Monitor for newly constructed network connections that are sent or received by untrusted hosts. |
| Network Traffic Content |
Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)). |
||
| Network Traffic Flow |
Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. |
||
| DS0009 | Process | Process Creation |
Monitor for applications and processes related to remote admin software. Correlate activity with other suspicious behavior that may reduce false positives if this type of software is used by legitimate users and administrators. Domain Fronting may be used in conjunction to avoid defenses. Adversaries will likely need to deploy and/or install these remote software to compromised systems. It may be possible to detect or prevent the installation of this type of software with host-based solutions. |