Remote Desktop Software
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
AN0714's real observable is a two-stage correlation — RMM install (file_event) followed by outbound beaconing (network_connection/dns_query) inside a time window — which Sigma cannot join across logsources or events. Collapsing to a single leg does not produce a distinct rule: the file_event leg would key on the same RMM binary names (AnyDesk, TeamViewer, ScreenConnect, AteraAgent, NinjaRMMAgent, GoToAssist, etc.) that T1219's published parent rule already encodes on ParentImage, just moved to TargetFilename, and the network_connection leg has no reliable per-tool port or hostname field in Sysmon EventID 3 to key on without inventing values not in the brief. […]
Covered instead by T1219.
What the technique is
An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as VNC, Team Viewer, AnyDesk, ScreenConnect, LogMein, AmmyyAdmin, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment. Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0714
Adversary installation or use of RMM software (e.g., TeamViewer, AnyDesk, ScreenConnect) followed by outbound beaconing or remote session establishment
- AN0715
Execution of known or custom VNC/remote desktop daemons or tunneling agents that initiate external communication after launch
- AN0716
Initiation of remote desktop sessions via AnyDesk, TeamViewer, or Chrome Remote Desktop accompanied by unexpected user logins or system modifications
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.