H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Remote Desktop Software

An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)

19 recorded

Relationships

mitigates
from Disable or Remove Feature or Program
Mitigation
mitigates
from Execution Prevention
Mitigation
mitigates
from Filter Network Traffic
Mitigation
subtechnique-of
to Remote Access Tools
Technique
uses
from C0015
Campaign
uses
from C0018
Campaign
uses
from C0027
Campaign
uses
from Contagious Interview
Group
uses
from Evilnum
Group
uses
from Kimsuky
Group
uses
from MuddyWater
Group
uses
from Mustang Panda
Group
uses
from Qilin
Malware
uses
from RTM
Group
uses
from Scattered Spider
Group
uses
from Storm-0501
Group
uses
from Storm-1811
Group
uses
from Thrip
Group
uses
from VOID MANTICORE
Group
6 external

References

mitre-attack
T1219.002
open
CrowdStrike 2015 Global Threat Report
https://go.crowdstrike.com/rs/281-OBQ-266/images/15GlobalThreatReport.pdf
open
CrySyS Blog TeamSpy
https://blog.crysys.hu/2013/03/teamspy/
open
Google Chrome Remote Desktop
https://support.google.com/chrome/answer/1649523
open
Chrome Remote Desktop
https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
open
Symantec Living off the Land
https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/istr-living-off-the-land-and-fileless-attack-techniques-en.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance