T1219.002 — Remote Desktop Software

Tactic: Command and Control · Platforms: Linux, macOS, Windows

An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input,…

Sub-technique of Remote Access Tools (T1219).

Sigma detection rules (3)

T1219.002 Remote Access Tools: Remote Desktop Software

title: "T1219.002 Remote Access Tools: Remote Desktop Software"
id: a7acf729-1ee1-4b7e-a3a0-4be84c4d395a
description: 'Detects execution of common third-party remote desktop / RMM software (AnyDesk, TeamViewer, ScreenConnect, LogMeIn, Ammyy Admin, VNC) that can be abused by adversaries as an interactive command and control channel. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: Image, ParentImage, AllowedRMMTools, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1219/002
author: Shahrukh Khan
date: 2026-06-21
license: MIT
tags:
  - attack.command-and-control
  - attack.t1219.002

logsource:
  category: process_creation
  product: windows

detection:
  selection:
    Image|endswith:
      - '\AnyDesk.exe'
      - '\TeamViewer.exe'
      - '\TeamViewer_Service.exe'
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\LogMeIn.exe'
      - '\LMIGuardianSvc.exe'
      - '\AA_v3.exe'
      - '\vncviewer.exe'
      - '\winvnc.exe'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Organization-sanctioned IT helpdesk or MSP use of the same remote-desktop/RMM tools.

level: medium

T1219.002 Remote Access Tools: Remote Desktop Software

title: "T1219.002 Remote Access Tools: Remote Desktop Software"
id: bb74e3cf-723e-4a1d-8d67-39de8e62e8bf
description: 'Remote Desktop Software Execution and Beaconing Detection. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Added VNC-family binaries (x11vnc, vncserver, Xvnc, tigervncserver, tightvncserver) and ScreenConnect/LogMeIn agent binaries, which the technique explicitly names as common Linux remote-desktop RMM software and which the prior binary list omitted entirely. Tune using: binary_name, OutboundIPRange.'
references:
  - https://attack.mitre.org/techniques/T1219/002
author: Shahrukh Khan
date: 2026-06-25
license: MIT
tags:
  - attack.command-and-control
  - attack.t1219.002

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/anydesk'
      - '/teamviewer'
      - '/nomachine'
      - '/x11vnc'
      - '/vncserver'
      - '/Xvnc'
      - '/tigervncserver'
      - '/tightvncserver'
      - '/screenconnect'
      - '/logmein'

  condition: selection

falsepositives:
  - Legitimate sanctioned remote-support tooling; scope OutboundIPRange to unexpected external destinations.
  - Sysadmins legitimately running a local VNC server (x11vnc/vncserver/Xvnc) for authorized remote administration or accessibility purposes.

level: high

T1219.002 Remote Access Tools: Remote Desktop Software

title: "T1219.002 Remote Access Tools: Remote Desktop Software"
id: 96a7e257-fe04-465b-a1c9-b2461da6b95d
description: 'Remote Desktop Software Execution and Beaconing Detection. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: process_signature, sandbox_exception.'
references:
  - https://attack.mitre.org/techniques/T1219/002
author: Shahrukh Khan
date: 2026-01-31
license: MIT
tags:
  - attack.command-and-control
  - attack.t1219.002

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    Image|contains: '.app/Contents/MacOS/'
    DestinationPort:
      - 443
    Image|endswith:
      - '/TeamViewer'
      - '/GoToAssist'
      - '/LogMeIn'
  condition: selection

falsepositives:
  - IDE and sandbox based remote access tools are also used legitimately by developers and support staff over the same outbound port 443, so this requires business context to separate malicious use from approved remote support.

level: medium

Related sub-techniques

Explore