{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1219","id":"T1219","name":"Remote Access Tools","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1219","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"a22ee99951c4ff4b3a167c938eda6ec49a69bc396e8455f32010569b74584f3f","description":"An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.\n\nRemote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system.\n\nInstallation of many remote access tools may also include persistence (e.g., the software's installation routine creates a [Windows Service](https://attack.mitre.org/techniques/T1543/003)). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1219","external_id":"T1219"},{"source_name":"CrowdStrike 2015 Global Threat Report","description":"CrowdStrike Intelligence. (2016). 2015 Global Threat Report. Retrieved April 11, 2018.","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/15GlobalThreatReport.pdf"},{"source_name":"CrySyS Blog TeamSpy","description":"CrySyS Lab. (2013, March 20). TeamSpy – Obshie manevri. Ispolzovat’ tolko s razreshenija S-a. Retrieved April 11, 2018.","url":"https://blog.crysys.hu/2013/03/teamspy/"},{"source_name":"Google Chrome Remote Desktop","description":"Google. (n.d.). Retrieved March 14, 2024.","url":"https://support.google.com/chrome/answer/1649523"},{"source_name":"Chrome Remote Desktop","description":"Huntress. (n.d.). Retrieved March 14, 2024.","url":"https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"},{"source_name":"Symantec Living off the Land","description":"Wueest, C., Anand, H. (2017, July). Living off the land and fileless attack techniques. Retrieved April 10, 2018.","url":"https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/istr-living-off-the-land-and-fileless-attack-techniques-en.pdf"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1219.001","id":"T1219.001","name":"IDE Tunneling","page":"techniques/enterprise/T1219.001/"},{"key":"enterprise/T1219.002","id":"T1219.002","name":"Remote Desktop Software","page":"techniques/enterprise/T1219.002/"},{"key":"enterprise/T1219.003","id":"T1219.003","name":"Remote Access Hardware","page":"techniques/enterprise/T1219.003/"}],"telemetry":[{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0060","name":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component","category":"Windows and directory audit","description":"Installation or registration of a service.","collection_focus":"Collect service-install auditing through Audit Security System Extension where supported, plus Service Control Manager/System logs and the new service configuration.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["service","action","executable","actor"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0060","collector":"illustrative-lab-collector","observation":{"service":"LabService","action":"install","executable":"C:\\Lab\\service.exe","actor":"lab-admin"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0056","name":"Windows Registry Key Creation","page":"telemetry/DC0056/","kind":"attack_component","category":"Endpoint activity","description":"Creation of Windows registry keys or values.","collection_focus":"Use RegistryEvent (12) and filter CreateKey/CreateValue as available; retain target object and process identity.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","process_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0056","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Demo","event_type":"CreateKey","process_id":4200}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1219","id":"T1219","name":"Remote Access Tools","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1219","technique_page":"techniques/enterprise/T1219/","page":"detections/enterprise/T1219/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d","title":"Potentially Suspicious File Creation by OpenEDR's ITSMService","status":"experimental","level":"medium","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_comodo_itsm_potentially_suspicious_file_creation.yml","author":"@kostastsale","kind":"sigma"},{"id":"7f3a9c2d-4e8b-4a7f-9d3e-5c6f8a9b2e1d","title":"OpenEDR Spawning Command Shell","status":"experimental","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/7f3a9c2d-4e8b-4a7f-9d3e-5c6f8a9b2e1d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_comodo_ssh_shellhost_cmd_spawn.yml","author":"@kostastsale","kind":"sigma"},{"id":"2db93a3f-3249-4f73-9e68-0e77a0f8ae7e","title":"Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server","status":"experimental","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/2db93a3f-3249-4f73-9e68-0e77a0f8ae7e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_remote_access_tools_tacticalrmm_agent_registration_via_cli.yml","author":"Ahmed Nosir (@egycondor)","kind":"sigma"},{"id":"4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c","title":"Suspicious Velociraptor Child Process","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_velociraptor_child_process.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"90d6bd71-dffb-4989-8d86-a827fedd6624","title":"Visual Studio Code Tunnel Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/90d6bd71-dffb-4989-8d86-a827fedd6624.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_vscode_tunnel_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems), citron_ninja","kind":"sigma"},{"id":"2cf29f11-e356-4f61-98c0-1bdb9393d6da","title":"Renamed Visual Studio Code Tunnel Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/2cf29f11-e356-4f61-98c0-1bdb9393d6da.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_vscode_tunnel_renamed_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0496","name":"Behavior-Chain Detection for Remote Access Tools (Tool-Agnostic)","url":"https://attack.mitre.org/detectionstrategies/DET0496","stix_id":"x-mitre-detection-strategy--ec412019-109f-4f84-aa2f-d623f40254e0","relationship_id":"relationship--153e37f3-37a6-439d-a7a1-888dc45673f0","description":"","analytics":[{"id":"AN1366","name":"Analytic 1366","guidance":"Chain of remote access tool behavior: (1) initial execution of remote-control/assist agent or GUI under user context; (2) persistence via service or autorun; (3) long-lived outbound connection/tunnel to external infrastructure; (4) interactive control signals such as shell or file-manager child processes spawned by the RAT parent.","url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1366","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Correlation period binding start→persistence→egress→child (default 15m, adjust per environment)."},{"field":"UserContext","description":"Differentiate help-desk/jump hosts and admin accounts from standard endpoints."},{"field":"ProcessAllowlist","description":"Known-good remote support tools; suppress expected events while still correlating anomalous sequences."},{"field":"InstallPathRegex","description":"Alert when services/agents execute from user-writable or temp paths."},{"field":"ExternalIPAllowlist","description":"Vendors’ support clouds/CDNs to reduce false positives on egress detection."},{"field":"ShellSpawnRegex","description":"Define which child shells from GUI parents are acceptable versus suspicious."},{"field":"EgressHeuristics","description":"Thresholds for session duration, connection counts, and bytes_out/bytes_in ratio."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1366","source_url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1366","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0060","component":"Service Creation","name":"WinEventLog:System","channel":"EventCode=7045","platforms":["Windows"],"analytic_id":"AN1366","source_url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1366","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0060/"},{"component_id":"DC0056","component":"Windows Registry Key Creation","name":"WinEventLog:Sysmon","channel":"EventCode=12","platforms":["Windows"],"analytic_id":"AN1366","source_url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1366","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0056/"},{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","platforms":["Windows"],"analytic_id":"AN1366","source_url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1366","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN1366","source_url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1366","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN1366","source_url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1366","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1367","name":"Analytic 1367","guidance":"Sequence of RAT agent execution, systemd persistence, and long-lived external egress; optional interactive shells spawned from the agent.","url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1367","platforms":["Linux"],"tuning":[{"field":"TimeWindow","description":"Bind exec→service→egress events; extend for staged deployments."},{"field":"DaemonAllowlist","description":"Approved .service names/paths to avoid flagging corporate agents."},{"field":"SuspiciousChildProcesses","description":"Define shells/interpreters considered anomalous when spawned by GUI/agent parents."},{"field":"EgressHeuristics","description":"Flow heuristics for long-lived, client-heavy connections post-install."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve: Agent/headless flags (listen/connect/reverse/tunnel) or remote-control binaries spawning shells","platforms":["Linux"],"analytic_id":"AN1367","source_url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1367","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0039","component":"File Creation","name":"auditd:PATH","channel":"WRITE: Drop of binaries/scripts in ~/.local, /tmp, or /opt tool dirs","platforms":["Linux"],"analytic_id":"AN1367","source_url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1367","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Linux"],"analytic_id":"AN1367","source_url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1367","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1368","name":"Analytic 1368","guidance":"Electron/GUI or headless RAT execution followed by LaunchAgent/Daemon persistence and persistent external connections; interactive children (osascript/sh/curl) spawned by parent.","url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1368","platforms":["macOS"],"tuning":[{"field":"AllowedAppBundlePaths","description":"Legitimate remote-support apps under /Applications."},{"field":"LaunchdAllowlist","description":"Known-good LaunchAgents/Daemons identifiers."},{"field":"TimeWindow","description":"Window for correlating exec→launchd→egress events."},{"field":"EgressHeuristics","description":"Duration/volume thresholds for persistent sessions."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"Process exec of remote-control apps or binaries with headless/connect flags","platforms":["macOS"],"analytic_id":"AN1368","source_url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1368","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0039","component":"File Creation","name":"macos:osquery","channel":"CREATE/MODIFY: Creation of LaunchAgents/Daemons plists in user/system locations","platforms":["macOS"],"analytic_id":"AN1368","source_url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1368","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"macos:osquery","channel":"CONNECT: Long-lived connections from remote-control parents to external IPs/domains","platforms":["macOS"],"analytic_id":"AN1368","source_url":"https://attack.mitre.org/detectionstrategies/DET0496#AN1368","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]}]}],"telemetry_references":[{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0060","name":"Service Creation","tag":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component"},{"id":"DC0056","name":"Windows Registry Key Creation","tag":"Windows Registry Key Creation","page":"telemetry/DC0056/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0030","name":"Carbanak","url":"https://attack.mitre.org/software/S0030","kind":"malware","description":"[Carbanak](https://attack.mitre.org/software/S0030) has a plugin for VNC and Ammyy Admin Tool.(Citation: FireEye CARBANAK June 2017)","relationship_id":"relationship--7fa238de-37c5-4224-b760-bf9f00001051","references":[{"source_name":"FireEye CARBANAK June 2017","description":"Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"}]},{"id":"S0148","name":"RTM","url":"https://attack.mitre.org/software/S0148","kind":"malware","description":"[RTM](https://attack.mitre.org/software/S0148) has the capability to download a VNC module from command and control (C2).(Citation: ESET RTM Feb 2017)","relationship_id":"relationship--14e8774f-a443-4065-b44d-5bb13b467c7c","references":[{"source_name":"ESET RTM Feb 2017","description":"Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) uses vncDll module to remote control the victim machine.(Citation: ESET Trickbot Oct 2020)(Citation: Bitdefender Trickbot March 2020)","relationship_id":"relationship--9f372adb-777a-4635-9310-cbb8f432f08e","references":[{"source_name":"ESET Trickbot Oct 2020","description":"Boutin, J. (2020, October 12). ESET takes part in global operation to disrupt Trickbot. Retrieved March 15, 2021.","url":"https://www.welivesecurity.com/2020/10/12/eset-takes-part-global-operation-disrupt-trickbot/"},{"source_name":"Bitdefender Trickbot March 2020","description":"Tudorica, R., Maximciuc, A., Vatamanu, C. (2020, March 18). New TrickBot Module Bruteforces RDP Connections, Targets Select Telecommunication Services in US and Hong Kong. Retrieved March 15, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/316/Bitdefender-Whitepaper-TrickBot-en-EN-interactive.pdf"}]},{"id":"S0384","name":"Dridex","url":"https://attack.mitre.org/software/S0384","kind":"malware","description":"[Dridex](https://attack.mitre.org/software/S0384) contains a module for VNC.(Citation: Dell Dridex Oct 2015)","relationship_id":"relationship--11d5cf7f-7b0c-49b3-b8d0-9906f440d2d0","references":[{"source_name":"Dell Dridex Oct 2015","description":"Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, October 13). Dridex (Bugat v5) Botnet Takeover Operation. Retrieved May 31, 2019.","url":"https://www.secureworks.com/research/dridex-bugat-v5-botnet-takeover-operation"}]},{"id":"S0554","name":"Egregor","url":"https://attack.mitre.org/software/S0554","kind":"malware","description":"[Egregor](https://attack.mitre.org/software/S0554) has checked for the LogMein event log in an attempt to encrypt files in remote machines.(Citation: Cyble Egregor Oct 2020)","relationship_id":"relationship--de071e4d-eee7-4ad5-96b6-fe83bfe3e25a","references":[{"source_name":"Cyble Egregor Oct 2020","description":"Cybleinc. (2020, October 31). Egregor Ransomware – A Deep Dive Into Its Activities and Techniques. Retrieved December 29, 2020.","url":"https://cybleinc.com/2020/10/31/egregor-ransomware-a-deep-dive-into-its-activities-and-techniques/"}]},{"id":"S0601","name":"Hildegard","url":"https://attack.mitre.org/software/S0601","kind":"malware","description":"[Hildegard](https://attack.mitre.org/software/S0601) has established tmate sessions for C2 communications.(Citation: Unit 42 Hildegard Malware)","relationship_id":"relationship--a0084acb-4ede-4dac-af86-857d5f381dac","references":[{"source_name":"Unit 42 Hildegard Malware","description":"Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"}]},{"id":"S1245","name":"InvisibleFerret","url":"https://attack.mitre.org/software/S1245","kind":"malware","description":"[InvisibleFerret](https://attack.mitre.org/software/S1245) has utilized remote access software including AnyDesk client through the “adc” module.(Citation: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023) [InvisibleFerret](https://attack.mitre.org/software/S1245) has also downloaded the AnyDesk client should it not already exist on the compromised host by searching for `C:/Program Files(x86)/AnyDesk/AnyDesk.exe`.(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024)","relationship_id":"relationship--aeeb9a14-a1e8-4721-8e07-2f25a21f7fa6","references":[{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","description":"eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025.","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","description":"Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025.","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","description":"Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]}],"actors":[{"id":"G0008","name":"Carbanak","url":"https://attack.mitre.org/groups/G0008","kind":"intrusion-set","description":"[Carbanak](https://attack.mitre.org/groups/G0008) used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.(Citation: Group-IB Anunak)","relationship_id":"relationship--af1514c0-0e58-4878-a409-9804a7ce5e0b","references":[{"source_name":"Group-IB Anunak","description":"Group-IB and Fox-IT. (2014, December). Anunak: APT against financial institutions. Retrieved April 20, 2016.","url":"http://www.group-ib.com/files/Anunak_APT_against_financial_institutions.pdf"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.(Citation: US-CERT Ukraine Feb 2016)(Citation: Microsoft Prestige ransomware October 2022)","relationship_id":"relationship--ad949bd4-7ffd-4712-91d8-4a8523db6b50","references":[{"source_name":"Microsoft Prestige ransomware October 2022","description":"MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"},{"source_name":"US-CERT Ukraine Feb 2016","description":"US-CERT. (2016, February 25). ICS Alert (IR-ALERT-H-16-056-01) Cyber-Attack Against Ukrainian Critical Infrastructure. Retrieved June 10, 2020.","url":"https://www.us-cert.gov/ics/alerts/IR-ALERT-H-16-056-01"}]},{"id":"G0046","name":"FIN7","url":"https://attack.mitre.org/groups/G0046","kind":"intrusion-set","description":"[FIN7](https://attack.mitre.org/groups/G0046) has utilized the remote management tool Atera to download malware to a compromised system.(Citation: Mandiant FIN7 Apr 2022)","relationship_id":"relationship--42684416-c3f0-4668-9c86-77482740179e","references":[{"source_name":"Mandiant FIN7 Apr 2022","description":"Abdo, B., et al. (2022, April 4). FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7. Retrieved April 5, 2022.","url":"https://www.mandiant.com/resources/evolution-of-fin7"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has incorporated remote monitoring and management (RMM) tools into their operations including [ngrok](https://attack.mitre.org/software/S0508).(Citation: Trend Micro Earth Simnavaz October 2024)","relationship_id":"relationship--30854ead-6837-413b-bb8e-fcca45b95dc0","references":[{"source_name":"Trend Micro Earth Simnavaz October 2024","description":"Fahmy, M. et al. (2024, October 11). Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East. Retrieved November 27, 2024.","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"}]},{"id":"G0080","name":"Cobalt Group","url":"https://attack.mitre.org/groups/G0080","kind":"intrusion-set","description":"[Cobalt Group](https://attack.mitre.org/groups/G0080) used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.(Citation: PTSecurity Cobalt Group Aug 2017)(Citation: PTSecurity Cobalt Dec 2016)(Citation: Group IB Cobalt Aug 2017)","relationship_id":"relationship--e74cdd3d-4ac7-42c5-a7ac-e2f58371fc5b","references":[{"source_name":"PTSecurity Cobalt Group Aug 2017","description":"Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"},{"source_name":"PTSecurity Cobalt Dec 2016","description":"Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"},{"source_name":"Group IB Cobalt Aug 2017","description":"Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.","url":"https://www.group-ib.com/blog/cobalt"}]},{"id":"G0105","name":"DarkVishnya","url":"https://attack.mitre.org/groups/G0105","kind":"intrusion-set","description":"[DarkVishnya](https://attack.mitre.org/groups/G0105) used DameWare Mini Remote Control for lateral movement.(Citation: Securelist DarkVishnya Dec 2018)","relationship_id":"relationship--96934e69-6d38-4ebd-970d-3d9bf88e03e3","references":[{"source_name":"Securelist DarkVishnya Dec 2018","description":"Golovanov, S. (2018, December 6). DarkVishnya: Banks attacked through direct connection to local network. Retrieved May 15, 2020.","url":"https://securelist.com/darkvishnya/89169/"}]},{"id":"G0115","name":"GOLD SOUTHFIELD","url":"https://attack.mitre.org/groups/G0115","kind":"intrusion-set","description":"[GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) has used the cloud-based remote management and monitoring tool \"ConnectWise Control\" to deploy [REvil](https://attack.mitre.org/software/S0496).(Citation: Tetra Defense Sodinokibi March 2020)","relationship_id":"relationship--58a574e4-ba44-4472-92fe-c50a9a9cbb49","references":[{"source_name":"Tetra Defense Sodinokibi March 2020","description":"Tetra Defense. (2020, March). CAUSE AND EFFECT: SODINOKIBI RANSOMWARE ANALYSIS. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20210414101816/https://tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis/"}]},{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has established tmate sessions for C2 communications.(Citation: Unit 42 Hildegard Malware)(Citation: Cisco Talos Intelligence Group)","relationship_id":"relationship--03527dc8-25a6-479d-b00f-90b543944da1","references":[{"source_name":"Unit 42 Hildegard Malware","description":"Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"},{"source_name":"Cisco Talos Intelligence Group","description":"Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"id":"G1024","name":"Akira","url":"https://attack.mitre.org/groups/G1024","kind":"intrusion-set","description":"[Akira](https://attack.mitre.org/groups/G1024) uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.(Citation: Secureworks GOLD SAHARA)(Citation: Arctic Wolf Akira 2023)","relationship_id":"relationship--e514f2a1-c3ae-403d-bbf4-8b72e29c49f1","references":[{"source_name":"Secureworks GOLD SAHARA","description":"Secureworks. (n.d.). GOLD SAHARA. Retrieved February 20, 2024.","url":"https://www.secureworks.com/research/threat-profiles/gold-sahara"},{"source_name":"Arctic Wolf Akira 2023","description":"Steven Campbell, Akshay Suthar, & Connor Belfiorre. (2023, July 26). Conti and Akira: Chained Together. Retrieved February 20, 2024.","url":"https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/"}]},{"id":"G1032","name":"INC Ransom","url":"https://attack.mitre.org/groups/G1032","kind":"intrusion-set","description":"\n[INC Ransom](https://attack.mitre.org/groups/G1032) has used AnyDesk and PuTTY on compromised systems.(Citation: Huntress INC Ransom Group August 2023)(Citation: SOCRadar INC Ransom January 2024)(Citation: Huntress INC Ransomware May 2024)(Citation: SentinelOne INC Ransomware)","relationship_id":"relationship--78601356-fa8e-47f5-b5ad-01549bac169f","references":[{"source_name":"Huntress INC Ransomware May 2024","description":"Carvey, H. (2024, May 1). LOLBin to INC Ransomware. Retrieved June 5, 2024.","url":"https://www.huntress.com/blog/lolbin-to-inc-ransomware"},{"source_name":"SentinelOne INC Ransomware","description":"SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.","url":"https://www.sentinelone.com/anthology/inc-ransom/"},{"source_name":"SOCRadar INC Ransom January 2024","description":"SOCRadar. (2024, January 24). Dark Web Profile: INC Ransom. Retrieved June 5, 2024.","url":"https://socradar.io/dark-web-profile-inc-ransom/"},{"source_name":"Huntress INC Ransom Group August 2023","description":"Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024.","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) has used tools such as AnyDesk in victim environments.(Citation: Picus BlackByte 2022)(Citation: Microsoft BlackByte 2023)","relationship_id":"relationship--e56fc7da-b0f8-4f18-99f4-e4b8b3258c9b","references":[{"source_name":"Picus BlackByte 2022","description":"Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024.","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"Microsoft BlackByte 2023","description":"Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has leveraged Remote Access Software for lateral movement and data exfiltration.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)(Citation: Security Scorecard Medusa Ransomware January 2024) [Medusa Group](https://attack.mitre.org/groups/G1051) has also been known to utilize Remote Access Software such as AnyDesk, Atera, ConnectWise, eHorus, N-Able, PDQ Deploy, PDQ Inventory, SimpleHelp and Splashtop.(Citation: CISA Medusa Group Medusa Ransomware March 2025)","relationship_id":"relationship--88fe25f5-7274-47bf-bdbc-8e1f1d127bdc","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","description":"Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","description":"Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","description":"Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"G1057","name":"ShinyHunters","url":"https://attack.mitre.org/groups/G1057","kind":"intrusion-set","description":"[ShinyHunters](https://attack.mitre.org/groups/G1057) has used MeshCentral and [ConnectWise](https://attack.mitre.org/software/S0591) to gain initial access, to run administrative command queries and to deploy the custom lateral movement and defacement script [victim_abbreviation]_fanout.sh.(Citation: Google_SHOracle_Jun2026)(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)   ","relationship_id":"relationship--9c3aa1cd-a210-4995-851f-7364bf5bb313","references":[{"source_name":"ElecticIQ Buyukkaya_ShinyHunters_Sept2025","description":"Büyükkaya, A. (2025, September 22). ShinyHunters Calling: Financially Motivated Data Extortion Group Targeting Enterprise Cloud Applications. Retrieved May 18, 2026.","url":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"},{"source_name":"Google_SHOracle_Jun2026","description":"Mandiant, Google Threat Intelligence Group. (2026, June 11). ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit. Retrieved June 11, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]}],"mitigations":[{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"Network intrusion detection and prevention systems that use network signatures may be able to prevent traffic to remote access services.","relationship_id":"relationship--d5c70727-794c-4404-b30d-0d798a62ad64","references":[]},{"id":"M1034","name":"Limit Hardware Installation","url":"https://attack.mitre.org/mitigations/M1034","kind":"course-of-action","description":"Block the use of IP-based KVM devices within the network if they are not required. ","relationship_id":"relationship--9ae55ec5-a4f8-4619-8565-fe00433c574a","references":[]},{"id":"M1037","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M1037","kind":"course-of-action","description":"Properly configure firewalls, application firewalls, and proxies to limit outgoing traffic to sites and services used by remote access software.","relationship_id":"relationship--80a23356-20b7-49a3-a48e-e0c04e2bff86","references":[]},{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"Use application control to mitigate installation and use of unapproved software that can be used for remote access.","relationship_id":"relationship--54306888-1f93-4461-bcac-a56ae7073b31","references":[]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Consider disabling unnecessary remote connection functionality, including both unapproved software installations and specific features built into supported applications.","relationship_id":"relationship--fa4c9d5a-3329-4138-b6e1-990cd7935b87","references":[]}],"candidates":[{"id":"0ae9e327-3251-465a-a53b-485d4e3f58fa","name":"Ammyy Admin Software Execution","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml","description":"An adversary may attempt to trick the user into downloading Ammyy Admin Remote Desktop Software for use as a C2 channel. \nUpon successful execution, Ammyy Admin will be executed. \n","inputs":{"Ammyy_Admin_Path":{"description":"Path of Ammyy Admin executable","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\ammyy.exe"}},"dependencies":[{"description":"Ammyy Admin must exist on disk at the specified location (#{Ammyy_Admin_Path})\n"}],"source_definition_sha256":"3cdd9df39df094bd76b7f9657d75206e8761ad6fd0e7d7650fe5e6feddb9a478"},{"id":"19acf63b-55c4-4b6a-8552-00a8865105c8","name":"UltraViewer - RAT Execution","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml","description":"A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as UltraViewer to provide the operator with access to the network using legitimate services. \n","inputs":{"UltraViewer_Path":{"description":"Path to the UltraViewer executable.","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\T1219_UltraViewer.exe"}},"dependencies":[{"description":"Ultraviewer installer must be downloaded and exist on the disk at the specified location. (#{UltraViewer_Path})\n"}],"source_definition_sha256":"2fbb9aa2b14f96d0756915d33b581b66cf98df5ed3cdfe4be9b2b2029f9342d6"},{"id":"1aea6d15-70f1-4b4e-8b02-397b5d5ffe75","name":"Microsoft App Quick Assist Execution","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml","description":"An adversary may attempt to trick a user into executing Microsoft Quick Assist Microsoft Store app and connect to the user's machine. \n","inputs":{},"dependencies":[],"source_definition_sha256":"3206d96bab1c1a9dc265f2ca9676a862f84e64bc4ff653bfe051c76009dd3568"},{"id":"1b72b3bd-72f8-4b63-a30b-84e91b9c3578","name":"GoToAssist Files Detected Test on Windows","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml","description":"An adversary may attempt to trick the user into downloading GoToAssist and use to establish C2. Download of GoToAssist installer will be at the destination location and ran when sucessfully executed.\n","inputs":{"installer_path":{"description":"where GoToAssist will be downloaded to or already is located","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\GoToAssist.exe"},"download_url":{"description":"url to download GoToAssist from","type":"url","default":"https://launch.getgo.com/launcher2/helper?token=e0-FaCddxmtMoX8_cY4czssnTeGvy83ihp8CLREfvwQshiBW0_RcbdoaEp8IA-Qn8wpbKlpGIflS-39gW6RuWRM-XHwtkRVMLBsp5RSKp-a3PBM-Pb1Fliy73EDgoaxr-q83WtXbLKqD7-u3cfDl9gKsymmhdkTGsXcDXir90NqKj92LsN_KpyYwV06lIxsdRekhNZjNwhkWrBa_hG8RQJqWSGk6tkZLVMuMufmn37eC2Cqqiwq5bCGnH5dYiSUUsklSedRLjh4N46qPYT1bAU0qD25ZPr-Kvf4Kzu9bT02q3Yntj02ZA99TxL2-SKzgryizoopBPg4Ilfo5t78UxKTYeEwo4etQECfkCRvenkTRlIHmowdbd88zz7NiccXnbHJZehgs6_-JSVjQIdPTXZbF9T5z44mi4BQYMtZAS3DE86F0C3D4Tcd7fa5F6Ve8rQWt7pvqFCYyiJAailslxOw0LsGyFokoy65tMF980ReP8zhVcTKYP8s8mhGXihUQJQPNk20Sw\"&\"downloadTrigger=restart\"&\"renameFile=1"}},"dependencies":[{"description":"GoToAssist must exist on disk at the specified location (#{installer_path})\n"}],"source_definition_sha256":"ed20f27a68c27ca9429cc9c8968c0285e6b81cb872e85c1b3b4d327fb9cc8020"},{"id":"3e1858ee-3550-401c-86ec-5e70ed79295b","name":"Splashtop Streamer Execution","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml","description":"An adversary may attempt to use Splashtop Streamer to gain unattended remote interactive access. Upon successful execution, Splashtop streamer will be executed.","inputs":{"srserver_exe":{"description":"Splashtop streamer installation executables","type":"string","default":"SRServer.exe"}},"dependencies":[{"description":"Splashtop Streamer must be installed in the location"}],"source_definition_sha256":"8c830b99325b0f0121e94d1cc6661136b571986681d6d2a9ba1a49d2fe177bbb"},{"id":"42e51815-a6cc-4c75-b970-3f0ff54b610e","name":"UltraVNC Execution","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml","description":"An adversary may attempt to trick the user into downloading UltraVNC for use as a C2 channel.\nUpon successful execution, UltraVNC will be executed.\n","inputs":{"UltraVNC_Viewer_Path":{"description":"Path of UltraVNC Viewer executable","type":"path","default":"$env:ProgramFiles\\'uvnc bvba\\UltraVnc\\vncviewer.exe'"}},"dependencies":[{"description":"UltraVNC must exist at (#{UltraVNC_Viewer_Path})\n"}],"source_definition_sha256":"ac0319e6af06a1e4dbc6589d855b9cd48bb2d82c63d4d0eea43936376587f485"},{"id":"4a18cc4e-416f-4966-9a9d-75731c4684c0","name":"ScreenConnect Application Download and Install on Windows","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml","description":"An adversary may attempt to trick the user into downloading ScreenConnect for use as a C2 channel. Download of ScreenConnect installer will be in the Downloads directory.\nMsiexec will be used to quietly insall ScreenConnect.\n","inputs":{},"dependencies":[],"source_definition_sha256":"62d8345a919e6a99ad532fde8d74764c8b086ee807379c4df49a12c00b8f7f46"},{"id":"6b8b7391-5c0a-4f8c-baee-78d8ce0ce330","name":"AnyDesk Files Detected Test on Windows","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml","description":"An adversary may attempt to trick the user into downloading AnyDesk and use to establish C2. Download of AnyDesk installer will be at the destination location and ran when sucessfully executed.\n","inputs":{"installer_path":{"description":"where the AnyDesk will be downloaded to or already is located","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\AnyDesk.exe"},"download_url":{"description":"url to download AnyDesk from","type":"url","default":"https://download.anydesk.com/AnyDesk.exe"}},"dependencies":[{"description":"AnyDesk must exist on disk at the specified location (#{installer_path})\n"}],"source_definition_sha256":"356c5d0be701682b715cd559f4e8c1df3d0ee1859186a45aa92ef3252a3b07bc"},{"id":"8ca3b96d-8983-4a7f-b125-fc98cc0a2aa0","name":"TeamViewer Files Detected Test on Windows","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml","description":"An adversary may attempt to trick the user into downloading teamviewer and using this to maintain access to the machine. Download of TeamViewer installer will be at the destination location when sucessfully executed.\n","inputs":{"installer_path":{"description":"where the installer will be downloaded to or already is located","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\TeamViewer_Setup_x64.exe"},"download_url":{"description":"url to download teamviewer from","type":"url","default":"https://download.teamviewer.com/download/TeamViewer_Setup_x64.exe"}},"dependencies":[{"description":"TeamViewer installer must exist on disk at the specified location (#{installer_path})\n"}],"source_definition_sha256":"fe56b4b321788b71a336500f31509bb2c0266af51639eedb45a6b2aac689cfad"},{"id":"b025c580-029e-4023-888d-a42710d76934","name":"Splashtop Execution","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml","description":"An adversary may attempt to trick the user into downloading Splashtop for use as a C2 channel.\nUpon successful execution, Splashtop will be executed.\n","inputs":{"Splashtop_Path":{"description":"Path of Splashtop executable","type":"path","default":"${env:programfiles(x86)}\\Splashtop\\Splashtop Remote\\Client for STP\\strwinclt.exe"}},"dependencies":[{"description":"Splashtop must exist at \"#{Splashtop_Path}\"\n"}],"source_definition_sha256":"ae1f38b41e6d850e91b33f2e9cced431c862b2e722e6c6975331754c01765a26"},{"id":"b1b8128b-c5d4-4de9-bf70-e60419274562","name":"MSP360 Connect Execution","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml","description":"An adversary may attempt to trick the user into downloading MSP360 Connect for use as a C2 channel.\nUpon successful execution, MSP360 Connect will be executed.\n","inputs":{"MSP360_Connect_Path":{"description":"Path of MSP360 executable","type":"path","default":"$env:ProgramFiles\\Connect\\Connect.exe"},"MSP360_Download_Url":{"description":"URL to download MSP360 Connect from","type":"url","default":null}},"dependencies":[{"description":"MSP360 must exist at (#{MSP360_Connect_Path})\n"}],"source_definition_sha256":"c1281d079188adea78fb05afc30a2a720da287aa8ac7eb0d1aeb7974e52f6f95"},{"id":"d03683ec-aae0-42f9-9b4c-534780e0f8e1","name":"LogMeIn Files Detected Test on Windows","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml","description":"An adversary may attempt to trick the user into downloading LogMeIn and use to establish C2. Download of LogMeIn installer will be at the destination location and ran when sucessfully executed.\n","inputs":{"installer_path":{"description":"where the installer will be downloaded to or already is located","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\LogMeInIgnition.msi"},"download_url":{"description":"url to download LogMeIn from","type":"url","default":"https://secure.logmein.com/LogMeInIgnition.msi"}},"dependencies":[{"description":"LogMeIn installer must exist on disk at the specified location (#{installer_path})\n"}],"source_definition_sha256":"6c0f3c2e5ebeca5f685d052c093f43c93b881e1d7add4d68ae98467e061f8194"},{"id":"ecca999b-e0c8-40e8-8416-ad320b146a75","name":"NetSupport - RAT Execution","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml","description":"A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as NetSupport to provide the operator with access to the network using legitimate services. \n","inputs":{"NetSupport_Path":{"description":"Path to the NetSupport executable.","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\T1219_NetSupport.exe"}},"dependencies":[{"description":"NetSupport must be downloaded and exist on the disk at the specified location. (#{NetSupport_Path})\n"}],"source_definition_sha256":"1a4b812280924384b5b2825b032445240d2e59e9c3ede8cd476480a0adb5092f"},{"id":"f1641ba9-919a-4323-b74f-33372333bf0e","name":"RustDesk Files Detected Test on Windows","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml","description":"An adversary may attempt to trick the user into downloading RustDesk and use this to maintain access to the machine. \nDownload of RustDesk installer will be at the destination location when successfully executed.\n","inputs":{"installer_path":{"description":"where the installer will be downloaded to or already is located","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\rustdesk-1.2.3-1-x86_64.exe"},"download_url":{"description":"url to download teamviewer from","type":"url","default":"https://github.com/rustdesk/rustdesk/releases/download/1.2.3-1/rustdesk-1.2.3-1-x86_64.exe"}},"dependencies":[{"description":"RustDesk must exist on disk at the specified location (#{installer_path})\n"}],"source_definition_sha256":"fde1fbeb32e53335c1e8076cb1d65e35a08b9f5b28dae59613a01e87e26f1dd1"},{"id":"fbff3f1f-b0bf-448e-840f-7e1687affdce","name":"RemotePC Software Execution","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml","description":"An adversary may attempt to trick the user into downloading RemotePC Software for use as a C2 channel. \nUpon successful execution, RemotePC will be executed. \n","inputs":{"RemotePC_Path":{"description":"Path of RemotePC executable","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\RemotePC.exe"}},"dependencies":[{"description":"RemotePC must exist on disk at the specified location (#{RemotePC_Path})\n"}],"source_definition_sha256":"99f8b015c798aefaf3efe835c166b10fba7cd80593bca6ea6ffc461f41c8d88c"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1543.003":"/ttp-simulation/techniques/enterprise/T1543.003/","T1219":"/ttp-simulation/techniques/enterprise/T1219/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1219","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0060","collector":"illustrative-lab-collector","observation":{"service":"LabService","action":"install","executable":"C:\\Lab\\service.exe","actor":"lab-admin"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0056","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Demo","event_type":"CreateKey","process_id":4200}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}