Remote support tools are on the approved list in many companies. MITRE ATT&CK tracks the abuse of them as T1219.002, Remote Desktop Software, a Remote Access Tools sub-technique in the Command and Control tactic. It applies to Linux, macOS and Windows.
How attackers use it
MITRE describes legitimate desktop support software used to establish an interactive command and control channel to target systems. This software provides a graphical interface for controlling another computer remotely, sending the display output, keyboard input and mouse control between devices over various protocols.
The page names VNC, TeamViewer, AnyDesk, ScreenConnect, LogMeIn, AmmyyAdmin and other remote monitoring and management (RMM) tools. They are commonly used as legitimate technical support software and may be allowed by application control in a target environment.
Remote access features may also live inside software you already use, such as Zoom or Chrome's Remote Desktop.
Why it works
Think about the defender's view. A support tool starts, opens an encrypted connection to a vendor's relay and lets someone move the mouse. Your own help desk does exactly that every day. If the tool is on an allow list, application control says yes. If the traffic is to a well known vendor, the proxy says yes.
The attacker's advantage is that the activity looks like IT.
How to detect it
The MITRE strategy has three analytics, each about a different pattern:
- Installation or use of RMM software such as TeamViewer, AnyDesk or ScreenConnect, followed by outbound beaconing or establishment of a remote session.
- Execution of known or custom VNC and remote desktop daemons, or tunneling agents, that start external communication after launch.
- Remote desktop sessions started through AnyDesk, TeamViewer or Chrome Remote Desktop, accompanied by unexpected user logins or system modifications.
Turn that into collection:
- Software inventory and process creation events, to see where these tools appear.
- DNS and proxy logs for the vendors' relay domains, by device.
- Service creation and autorun changes. Many installers add a service.
- Logon events around the time a remote session begins, so you can compare them with expected activity.
Tuning
Your help desk will use one or two products. Write them down, and tie their use to tickets. Then treat every other remote desktop product as a finding, and treat approved products on machines with no matching ticket as a question.
Pay attention to portable or no-install versions of these tools. They may not appear in your software inventory but will show up in process creation and DNS logs.
How to reduce the risk
MITRE lists three mitigations.
- Disable or remove the feature or program. Disable unnecessary remote connection functionality, including unapproved software installations and built-in features of supported applications.
- Filter network traffic. Configure firewalls, application firewalls and proxies to limit outgoing traffic to the sites and services used by remote access software.
- Execution prevention. Use application control to stop installation and use of unapproved software that can be used for remote access.
A practical pattern:
- Pick one sanctioned remote support product.
- Block the relay domains of every other product at the proxy and DNS layer.
- Use application control so only the approved product's publisher or path can run.
- Turn off remote control features in collaboration tools that your users do not need.
Find the tools you did not install
Unapproved remote tools usually appear on machines you do not manage well. Asset discovery gives you the starting list of hosts and what runs on them.
Try it yourself
Click through it at your own pace, or open it full screen.
Check your own environment
- Which remote desktop products are installed across your fleet right now?
- Does your allow list name a vendor or a specific signed product?
- Can you list the devices that contacted remote support relay domains this month?
- Are the remote features of Zoom, Chrome and similar apps governed by policy?
This read-only PowerShell command lists installed programs on Windows from the registry, so you can scan for remote access tools:
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, Publisher, InstallDate
Note that portable tools will not appear in that list, so also review process and DNS data.
What good looks like
Good looks like a short allow list and long block list. One product is approved and its use is tied to tickets. Every other remote desktop product is blocked at install, at execution and at the network. Portable copies still show up, because process and DNS logs cover them. And when something does appear, the alert includes who was logged on and what changed on the machine.
Quick check
Why do attackers choose commercial remote desktop tools?
They are often allowed by application control and look like normal IT support activity, so the session blends in.
What does MITRE recommend for network controls?
Limit outgoing traffic to the sites and services used by remote access software, using firewalls, application firewalls and proxies.
Which signals does MITRE pair with a remote session?
Unexpected user logins or system modifications, and outbound beaconing after launch.
Sources
- MITRE ATT&CK, T1219.002: https://attack.mitre.org/techniques/T1219/002
