attack.t1219.002

Antivirus Exploitation Framework Detection

Jun 13, 2025 · attack.execution attack.t1203 attack.command-and-control attack.t1219.002 ·

Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Anydesk Temporary Artefact

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Atera Agent Installation

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators

DNS Query To AzureWebsites.NET By Non-Browser Process

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects a DNS query by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.

DNS Query To Remote Access Software Domain From Non-Browser App

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

GoToAssist Temporary Installation Artefact

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

HackTool - Inveigh Execution Artefacts

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects the presence and execution of Inveigh via dropped artefacts

HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects the creation of file with specific names used by RemoteKrbRelay SMB Relay attack module.

Hijack Legit RDP Session to Move Laterally

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder

Installation of TeamViewer Desktop

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

TeamViewer_Desktop.exe is create during install

Mesh Agent Service Installation

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers

Mstsc.EXE Execution With Local RDP File

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file

Potential Amazon SSM Agent Hijacking

Jun 13, 2025 · attack.command-and-control attack.persistence attack.t1219.002 ·

Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Potential CSharp Streamer RAT Loading .NET Executable Image

Jun 13, 2025 · attack.command-and-control attack.t1219.002 detection.emerging-threats ·

Share on:

Detects potential CSharp Streamer RAT loading .NET executable image by using the default file name and path associated with the tool.

Potential Linux Amazon SSM Agent Hijacking

Jun 13, 2025 · attack.command-and-control attack.persistence attack.t1219.002 ·

Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Potential Remote Desktop Connection to Non-Domain Host

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects logons using NTLM to hosts that are potentially not part of the domain.

Potential SocGholish Second Stage C2 DNS Query

Jun 13, 2025 · attack.command-and-control attack.t1219.002 detection.emerging-threats ·

Share on:

Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic

QuickAssist Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain remote access.

Remote Access Tool - AnyDesk Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - Anydesk Execution From Suspicious Folder

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - AnyDesk Incoming Connection

Jun 13, 2025 · attack.persistence attack.command-and-control attack.t1219.002 ·

Share on:

Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel.

Remote Access Tool - AnyDesk Piped Password Via CLI

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.

Remote Access Tool - AnyDesk Silent Installation

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.

Remote Access Tool - GoToAssist Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - LogMeIn Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - MeshAgent Command Execution via MeshCentral

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.

Remote Access Tool - NetSupport Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - ScreenConnect Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects potentially suspicious child processes launched via the ScreenConnect client service.

Remote Access Tool - Simple Help Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote Access Tool - UltraViewer Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

ScreenConnect Temporary Installation Artefact

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Suspicious Binary Writes Via AnyDesk

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll, which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)

Suspicious Mstsc.EXE Execution With Local RDP File

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Suspicious TSCON Start as SYSTEM

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects a tscon.exe start as LOCAL SYSTEM

TacticalRMM Service Installation

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool.

TeamViewer Domain Query By Non-TeamViewer Application

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation)

TeamViewer Remote Session

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

Detects the creation of log files during a TeamViewer remote session

Use of UltraVNC Remote Access Software

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·

Share on:

An adversary may use legitimate desktop support and remote access software,to establish an interactive command and control channel to target systems within networks