Detections
Analytics
Remote Access Software
Description
An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as VNC, Team Viewer, AnyDesk, ScreenConnect, LogMein, AmmyyAdmin, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment
Products, Sensors, and Dependencies
| Product | Dependencies | Data source | Access required | Protocol | Data Collected | Notes |
|---|---|---|---|---|---|---|
| Tenable Vulnerability Management | Advanced Network Scan | Windows machines | Authenticated Scan | SMB | List of Software | Plugin ID: 20811 |
References
Attack Path Technique Details
Framework: MITRE ATT&CK
Family: Command and Control
Technique: Remote Access Software
Sub-Technique: Remote Access Software
Platform: Windows
Products Required: Tenable Vulnerability Management
Tenable Release Date: 2024 Q1