// MITRE ATT&CK
T1219.002 · Remote Desktop Software
Sub-technique of T1219 · Remote Access Tools.
An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and ...
How to detect & mitigate it
Detecting Remote Desktop Software starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1132.001
Standard Encoding T1568.002
Domain Generation Algorithms T1071.004
DNS T1071.005
Publish/Subscribe Protocols T1573.001
Symmetric Cryptography T1568.001
Fast Flux DNS T1071
Application Layer Protocol T1219
Remote Access Tools
Standard Encoding T1568.002
Domain Generation Algorithms T1071.004
DNS T1071.005
Publish/Subscribe Protocols T1573.001
Symmetric Cryptography T1568.001
Fast Flux DNS T1071
Application Layer Protocol T1219
Remote Access Tools
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.