T1219: Remote Access Tools
AI Answer
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over (Source: MITRE ATT&CK T1219)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1219 |
| Name | Remote Access Tools |
| Tactic | Command and Control (command-and-control) |
| Platforms | Linux, macOS, Windows |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, Remote Access Tools (T1219) is one of the highest-connectivity ATT&CK techniques: 22 MITRE STIX relationships reference this technique; 13 threat groups observed using it; 7 software families associated; 2 campaigns associated; 3 OpenTrojan content pages reference it. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1219). An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access. Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system. Installation of many remote access tools may also include persistence (e.g., the software’s installation routine creates a Windows Service). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).
Detection
Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.
Mitigation
Use intrusion detection signatures to block traffic at network boundaries.
Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.
Related Software
- TrickBot
- InvisibleFerret
- Hildegard
- Carbanak
- RTM
- Egregor
- Dridex
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- BlackByte
- TeamTNT
- FIN7
- Sandworm Team
- Akira
- OilRig
- Carbanak
- DarkVishnya
- Medusa Group
- GOLD SOUTHFIELD
- INC Ransom
- Cobalt Group
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- Operation AkaiRyū
- Night Dragon
Campaign associations are from MITRE ATT&CK STIX relationships.
Related Content
References
- https://attack.mitre.org/techniques/T1219
- https://go.crowdstrike.com/rs/281-OBQ-266/images/15GlobalThreatReport.pdf
- https://blog.crysys.hu/2013/03/teamspy
- https://support.google.com/chrome/answer/1649523
- https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
- https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/istr-living-off-the-land-and-fileless-attack-techniques-en.pdf
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1219 Remote Access Tools. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1219 Remote Access Tools?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.