Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Command and Control/ T1219

T1219Remote Access Tools

T1219 — Remote Access Tools is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 29 detection use cases covering it and 78 threat-intel articles citing it.

Command and Control
View on the matrix → Filter Detection Library MITRE official spec ↗
29Use cases
78Articles
3Sub-techniques
1Tactic

Sub-techniques (3)

T1219.001 · IDE TunnelingT1219.003 · Remote Access HardwareT1219.002 · Remote Desktop Software

Use cases covering this technique (29)

RMM tool installed by non-IT user — remote-access utility for hands-on-keyboard Internal install · hunting DSΣP Detect Remote Access Software Usage File ESCU actions · hunting P Detect Remote Access Software Usage FileInfo ESCU actions · hunting P Detect Remote Access Software Usage Process ESCU actions · hunting P Detect Remote Access Software Usage Registry ESCU actions · hunting P Windows Level RMM PowerShell Script Installer ESCU actions · hunting P Windows Level RMM Watchdog Task Created ESCU actions · hunting P Windows Remote Access Software BRC4 Loaded Dll ESCU actions · hunting P Windows Remote Access Software RMS Registry ESCU actions · alerting P Windows RMM Tool Execution ESCU actions · hunting P Cisco Secure Firewall - Communication Over Suspicious Ports ESCU actions · hunting P Cisco Secure Firewall - Remote Access Software Usage Traffic ESCU actions · hunting P Detect Remote Access Software Usage DNS ESCU actions · hunting P Detect Remote Access Software Usage Traffic ESCU actions · hunting P HTTP RMM User Agent ESCU actions · hunting P Detect Remote Access Software Usage URL ESCU actions · hunting P Windows Remote Access Software Hunt ESCU actions · hunting P [LLM] esxi.sh downloader deploys architecture-specific reverse_ssh from 185.144.28.120 Bespoke install · hunting DSΣPDDCS [LLM] Managed endpoint network egress to DPRK IT-worker VPS / AstrillVPN IPs Bespoke c2 · hunting DSΣPDDCS [LLM] Reverse-shell egress from Flowise node process tree (nc/shell child dialing out) Bespoke c2 · alerting DSPCS [LLM] AnyDesk silent/unattended install used for DragonForce access Bespoke c2 · alerting DSΣPDDCS [LLM] Trojanized MeshAgent running outside its install path (Sinobi ransomware C2) Bespoke c2 · alerting DSΣPDDCS [LLM] Zoho Assist Unattended Agent deployment (Warlock / Storm-2603 ransomware) Bespoke install · alerting DSΣPDDCS [LLM] Trojanized MeshAgent installed as SYSTEM auto-start service (Sinobi covert C2) Bespoke install · alerting DSΣDDCS [LLM] Zoho Assist Unattended Agent deployment for headless remote access (Warlock / Storm-2603) Bespoke install · alerting DSΣDDCS [LLM] Outbound C2 to PlugX/ShadowPad/Cobalt Strike/Remcos infrastructure targeting Pakistani law enforcement Bespoke c2 · alerting DSΣPDDCS [LLM] OpenClaw Gateway WebSocket listener / loopback connection on TCP 18789 Bespoke c2 · hunting DSΣPDDCS [LLM] MuddyWater SimpleHelp RMM client spawning shell or recon LOLBin Bespoke install · alerting DSΣP [LLM] ScreenConnect MSI sideload from lmfao.su (Solidity Language post-exploit RAT install) Bespoke install · alerting DSΣPDDCS

Articles citing this technique (78)

crit Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access art-23
crit Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware art-28
high The Model Is the Malware | What Four Agentic Intrusions Tell Defenders art-57
crit North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring art-59
crit Enterprise Defenses Recovered at the Edge and Collapsed Inside art-70
crit Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack art-78
high DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt art-82
crit DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure art-98
crit Inside the Modern SOC: The Identity Front Door art-102
crit 128 Seconds to disruption: Microsoft Defender stops ransomware at QNET art-124
crit [GHSA / CRITICAL] CVE-2026-69254: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override art-129
high The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software art-131
crit How legitimate cloud platforms enable phishers to bypass MFA art-133
crit An analysis of incidents at Brazilian educational institutions art-146
crit CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft art-151
crit [GHSA / CRITICAL] CVE-2026-66066: Active Storage has possible arbitrary file read and remote code execution in Active Storage variant proces art-164
crit You were onto something with “It’s the Climb,” Miley art-165
crit OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia art-169
high Four incident-response decisions from the Hugging Face breach art-175
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188
med The Generator Can't Be the Validator: What OpenAI's Hugging Face Incident Proves About AI Security art-189
high Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis? art-223
high Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters art-237
crit Begun, the Patch Wars have art-253
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-256
crit Coordinated AsyncAPI Supply Chain Attack: Miasma RAT Delivered via Compromised CI/CD Pipelines in Two Repositories art-259
crit [GHSA / CRITICAL] CVE-2026-54088: File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) art-297
crit One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement art-309
high codfish/semantic-release-action GitHub Action has been compromised art-331
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-344
crit OceanLotus: From external espionage to domestic targeting art-388
high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter art-396
crit Webworm: New burrowing techniques art-459
crit PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale art-492
crit CISA KEV: CVE-2024-1708 — ConnectWise ScreenConnect Path Traversal Vulnerability art-518
high Securing Vibe Coding and AI Coding Agents: An End-to-End Approach with StepSecurity art-562
high Behind the Scenes: How StepSecurity Detected and Helped Remediate the Largest npm Supply Chain Attack art-567
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-568
crit Cline Supply Chain Attack Detected: cline@2.3.0 Silently Installs OpenClaw art-571
high As breakout time accelerates, prevention-first cybersecurity takes center stage art-574
high Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT art-585
crit litellm: Credential Stealer Hidden in PyPI Wheel art-587
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-593
med Cloud workload security: Mind the gaps art-604
crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-605
crit Cyber fallout from the Iran war: What to have on your radar art-626
crit Protecting education: How MDR can tip the balance in favor of schools art-640
crit Naming and shaming: How ransomware groups tighten the screws on victims art-678
high ServiceNow's Virtual Agent Vulnerability Shows Why AI Security Needs Traditional AppSec Foundations art-741
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-758
high Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack art-875
high Cursor IDE Malware Extension Compromise in $500k Crypto Heist art-924
high Finding Software Flaws Early in the Development Process Provides Clear ROI art-951
crit CISA KEV: CVE-2025-3935 — ConnectWise ScreenConnect Improper Authentication Vulnerability art-968
high Understanding command injection vulnerabilities in Go art-1174
crit CISA KEV: CVE-2024-1709 — ConnectWise ScreenConnect Authentication Bypass Vulnerability art-1419
med A day in the life of an ethical hacker art-1720
crit CISA KEV: CVE-2022-36537 — ZK Framework AuUploader Unspecified Vulnerability art-1852
high The security concerns of a JavaScript sandbox with the Node.js VM module art-1854
med New year ushers in new wave of Snyk Technology Alliance Partner Program members art-1887
crit Key points from Google and Accenture's ransomware white paper art-1958
high SREs bring ORDER(R) to CHAOS art-1988
med Cloud security fundamentals part 2: Prevention and secure design art-1995
high Cloud security fundamentals part 1: Know your environment art-2006
med How Onna Technologies uses Snyk & Sysdig to secure the SDLC while saving time and money art-2039
high Cloud Security at Blackhat and Defcon 2022 art-2056
high Securing PHP containers art-2105
crit CISA KEV: CVE-2017-18362 — Kaseya VSA SQL Injection Vulnerability art-2238
med Cloud security challenges art-2270
crit CISA KEV: CVE-2018-20753 — Kaseya VSA Remote Code Execution Vulnerability art-2334
crit Case study: Python RCE vulnerability in Celery art-2637
med 8 best Java code review tools for developers art-2711
high Snyk IaC in 2021: Leading infrastructure as code security for developers art-2741
crit CISA KEV: CVE-2021-30116 — Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability art-2916
crit CISA KEV: CVE-2019-18988 — TeamViewer Desktop Bypass Remote Login Vulnerability art-3046
med Why the Facebook outage and Twitch breach matter to business leaders art-3093
crit Preventing malicious packages and supply chain attacks with Snyk art-3117
high A technical analysis of the Capital One cloud misconfiguration breach art-3518