T1219.002 Remote Desktop Software — Detection Rules

Detection workspace for T1219.002 Remote Desktop Software: 41 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.

Source-backed rule directory

Antivirus Exploitation Framework Detection · stable · critical · {"category":"antivirus"}
Potential Linux Amazon SSM Agent Hijacking · test · medium · {"category":"process_creation","product":"linux"}
Remote Access Tool - Potential MeshAgent Execution - MacOS · experimental · medium · {"category":"process_creation","product":"macos"}
Remote Access Tool - Renamed MeshAgent Execution - MacOS · experimental · high · {"category":"process_creation","product":"macos"}
Atera Agent Installation · test · high · {"service":"application","product":"windows"}
Potential Remote Desktop Connection to Non-Domain Host · test · medium · {"product":"windows","service":"ntlm","definition":"Requires events from Microsoft-Windows-NTLM/Operational"}
Mesh Agent Service Installation · test · medium · {"product":"windows","service":"system"}
TacticalRMM Service Installation · test · medium · {"product":"windows","service":"system"}
DNS Query To AzureWebsites.NET By Non-Browser Process · test · medium · {"product":"windows","category":"dns_query"}
DNS Query To Remote Access Software Domain From Non-Browser App · test · medium · {"product":"windows","category":"dns_query"}
TeamViewer Domain Query By Non-TeamViewer Application · test · medium · {"product":"windows","category":"dns_query"}
Anydesk Temporary Artefact · test · medium · {"category":"file_event","product":"windows"}
Suspicious Binary Writes Via AnyDesk · test · high · {"product":"windows","category":"file_event"}
GoToAssist Temporary Installation Artefact · test · medium · {"category":"file_event","product":"windows"}
HackTool - Inveigh Execution Artefacts · test · critical · {"product":"windows","category":"file_event"}
HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators · test · high · {"product":"windows","category":"file_event"}
Installation of TeamViewer Desktop · test · medium · {"product":"windows","category":"file_event"}
ScreenConnect Temporary Installation Artefact · test · medium · {"category":"file_event","product":"windows"}
TeamViewer Remote Session · test · medium · {"product":"windows","category":"file_event"}
Hijack Legit RDP Session to Move Laterally · test · high · {"product":"windows","category":"file_event"}
Remote Access Tool - AnyDesk Incoming Connection · experimental · medium · {"category":"network_connection","product":"windows"}
Mstsc.EXE Execution With Local RDP File · test · low · {"category":"process_creation","product":"windows"}
Suspicious Mstsc.EXE Execution With Local RDP File · test · high · {"category":"process_creation","product":"windows"}
QuickAssist Execution · experimental · low · {"category":"process_creation","product":"windows"}
Remote Access Tool - AnyDesk Execution · test · medium · {"category":"process_creation","product":"windows"}
Remote Access Tool - AnyDesk Piped Password Via CLI · test · medium · {"category":"process_creation","product":"windows"}
Remote Access Tool - AnyDesk Silent Installation · test · high · {"category":"process_creation","product":"windows"}
Remote Access Tool - Anydesk Execution From Suspicious Folder · test · high · {"category":"process_creation","product":"windows"}
Remote Access Tool - GoToAssist Execution · test · medium · {"category":"process_creation","product":"windows"}
Remote Access Tool - LogMeIn Execution · test · medium · {"category":"process_creation","product":"windows"}
Remote Access Tool - Potential MeshAgent Execution - Windows · experimental · medium · {"category":"process_creation","product":"windows"}
Remote Access Tool - MeshAgent Command Execution via MeshCentral · test · medium · {"product":"windows","category":"process_creation"}
Remote Access Tool - NetSupport Execution · test · medium · {"category":"process_creation","product":"windows"}
Remote Access Tool - Renamed MeshAgent Execution - Windows · experimental · high · {"category":"process_creation","product":"windows"}
Remote Access Tool - ScreenConnect Execution · test · medium · {"category":"process_creation","product":"windows"}
Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution · test · medium · {"product":"windows","category":"process_creation"}
Remote Access Tool - Simple Help Execution · test · medium · {"category":"process_creation","product":"windows"}
Remote Access Tool - UltraViewer Execution · test · medium · {"category":"process_creation","product":"windows"}
Potential Amazon SSM Agent Hijacking · test · medium · {"category":"process_creation","product":"windows"}
Suspicious TSCON Start as SYSTEM · test · high · {"category":"process_creation","product":"windows"}
Use of UltraVNC Remote Access Software · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0259 Remote Desktop Software Execution and Beaconing Detection

AN0714 Analytic 0714

Adversary installation or use of RMM software (e.g., TeamViewer, AnyDesk, ScreenConnect) followed by outbound beaconing or remote session establishment

AN0715 Analytic 0715

Execution of known or custom VNC/remote desktop daemons or tunneling agents that initiate external communication after launch

AN0716 Analytic 0716

Initiation of remote desktop sessions via AnyDesk, TeamViewer, or Chrome Remote Desktop accompanied by unexpected user logins or system modifications

Connected ecosystem references

Linked tags

rule_source_available

Simulation, tools and telemetry

T1219.002 simulation workspace

No reviewed association in this snapshot.

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing anomaly research

Original publication snapshot · Anomaly Detection Atlas

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.