They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system. Remote access tools may be installed and used post-compromise as alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.(Citation: Symantec Living off the Land) These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Try it using Invoke-Atomic Remote Access Software Description from ATT&CKĪn adversary may use legitimate desktop support and remote access software, such as Team Viewer, AnyDesk, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. Atomic Test #9 - UltraViewer - RAT Execution.Atomic Test #8 - NetSupport - RAT Execution.Atomic Test #7 - RemotePC Software Execution.Atomic Test #6 - Ammyy Admin Software Execution.Atomic Test #5 - ScreenConnect Application Download and Install on Windows.Atomic Test #4 - GoToAssist Files Detected Test on Windows.Atomic Test #3 - LogMeIn Files Detected Test on Windows.Atomic Test #2 - AnyDesk Files Detected Test on Windows.Atomic Test #1 - TeamViewer Files Detected Test on Windows.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |