Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Command and Control/ T1219

T1219Remote Access Tools

T1219 — Remote Access Tools is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 27 detection use cases covering it and 87 threat-intel articles citing it.

Command and Control
View on the matrix → Filter Detection Library MITRE official spec ↗
27Use cases
87Articles
3Sub-techniques
1Tactic

Sub-techniques (3)

T1219.001 · IDE TunnelingT1219.003 · Remote Access HardwareT1219.002 · Remote Desktop Software

Use cases covering this technique (27)

RMM tool installed by non-IT user — remote-access utility for hands-on-keyboard Internal install · hunting DSΣP Detect Remote Access Software Usage File ESCU actions · hunting P Detect Remote Access Software Usage FileInfo ESCU actions · hunting P Detect Remote Access Software Usage Process ESCU actions · hunting P Detect Remote Access Software Usage Registry ESCU actions · hunting P Windows Level RMM PowerShell Script Installer ESCU actions · hunting P Windows Level RMM Watchdog Task Created ESCU actions · hunting P Windows Remote Access Software BRC4 Loaded Dll ESCU actions · hunting P Windows Remote Access Software RMS Registry ESCU actions · alerting P Windows RMM Tool Execution ESCU actions · hunting P Cisco Secure Firewall - Communication Over Suspicious Ports ESCU actions · hunting P Cisco Secure Firewall - Remote Access Software Usage Traffic ESCU actions · hunting P Detect Remote Access Software Usage DNS ESCU actions · hunting P Detect Remote Access Software Usage Traffic ESCU actions · hunting P HTTP RMM User Agent ESCU actions · hunting P Detect Remote Access Software Usage URL ESCU actions · hunting P Windows Remote Access Software Hunt ESCU actions · hunting P [LLM] Trojanized MeshAgent covert backdoor: SYSTEM service beaconing over WSS (Sinobi) Bespoke c2 · hunting DSΣPDDCS [LLM] Zoho Assist Unattended Agent deployed for headless remote control (Warlock/Storm-2603) Bespoke install · hunting DSΣPDDCS [LLM] Level RMM enrollment with BlueDash attacker API key (GxSCHE8EZwfyYN3iPQHPai8D) Bespoke install · alerting DSΣPDDCS [LLM] Multiple RMM agents co-resident on one host (BlueDash redundant access) Bespoke install · alerting DSPDDCS [LLM] Unsanctioned RMM trio deployment: Endpoint Central, Mesh Agent, Tactical RMM Bespoke c2 · hunting DSPDDCS [LLM] The Gentlemen SystemBC C2 beacon to known operator IPs Bespoke c2 · hunting DSΣPDDCS [LLM] Outbound C2 to PlugX/ShadowPad/Cobalt Strike/Remcos infrastructure targeting Pakistani law enforcement Bespoke c2 · alerting DSΣPDDCS [LLM] OpenClaw Gateway WebSocket listener / loopback connection on TCP 18789 Bespoke c2 · hunting DSΣPDDCS [LLM] MuddyWater SimpleHelp RMM client spawning shell or recon LOLBin Bespoke install · alerting DSΣP [LLM] ScreenConnect MSI sideload from lmfao.su (Solidity Language post-exploit RAT install) Bespoke install · alerting DSΣPDDCS

Articles citing this technique (87)

high Four incident-response decisions from the Hugging Face breach art-04
crit Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads art-06
crit OpenAI agent used exposed credentials at 4 services in Hugging Face breach art-09
crit OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach art-27
high OpenAI models used Artifactory zero-days to escape to the internet art-38
high CISA shares advice on isolating vital systems during cyberattacks art-40
crit 24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login art-44
crit JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach art-47
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-50
med The Generator Can't Be the Validator: What OpenAI's Hugging Face Incident Proves About AI Security art-56
high NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework art-57
high Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update art-64
crit DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts art-76
crit BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery art-96
crit Email threat landscape: Q2 2026 trends and insights art-108
high Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis? art-116
high Real world incident response: Microsoft and AXA XL strengthen cyber resilience art-117
high A new extortion cocktail: office printers, small ransoms, and BitLocker art-130
high Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters art-131
high ACR Stealer: Two observed intrusion chains amid increased threat activity art-146
crit Begun, the Patch Wars have art-150
high GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration art-153
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-156
crit No Manners Here: The Ruthless Rise of The Gentlemen Ransomware art-198
crit [GHSA / CRITICAL] CVE-2026-54088: File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) art-202
crit One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement art-216
crit [GHSA / CRITICAL] CVE-2026-52831: Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persisten art-220
crit Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign art-250
high How We Added WebAuthn to a Browser-Based RDP Client art-251
crit Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects art-265
high codfish/semantic-release-action GitHub Action has been compromised art-276
high Threat Brief: Mitigating Large-Scale Credential Attacks art-289
crit CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure art-293
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-294
crit Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE art-327
crit Inside the Modern SOC: The 72-Minute Race art-330
crit OceanLotus: From external espionage to domestic targeting art-342
high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter art-350
crit Webworm: New burrowing techniques art-413
crit PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale art-446
crit CISA KEV: CVE-2024-1708 — ConnectWise ScreenConnect Path Traversal Vulnerability art-473
high Securing Vibe Coding and AI Coding Agents: An End-to-End Approach with StepSecurity art-517
high Behind the Scenes: How StepSecurity Detected and Helped Remediate the Largest npm Supply Chain Attack art-522
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-523
crit Cline Supply Chain Attack Detected: cline@2.3.0 Silently Installs OpenClaw art-526
high As breakout time accelerates, prevention-first cybersecurity takes center stage art-530
high Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT art-542
crit litellm: Credential Stealer Hidden in PyPI Wheel art-545
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-552
med Cloud workload security: Mind the gaps art-564
crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-565
high CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran art-566
crit Cyber fallout from the Iran war: What to have on your radar art-593
crit Protecting education: How MDR can tip the balance in favor of schools art-607
crit Naming and shaming: How ransomware groups tighten the screws on victims art-645
high ServiceNow's Virtual Agent Vulnerability Shows Why AI Security Needs Traditional AppSec Foundations art-710
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-728
crit ESET APT Activity Report Q2 2025–Q3 2025 art-793
high Sharing is scaring: The WhatsApp scam you didn’t see coming art-794
high Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack art-852
high Cursor IDE Malware Extension Compromise in $500k Crypto Heist art-900
high Finding Software Flaws Early in the Development Process Provides Clear ROI art-928
crit CISA KEV: CVE-2025-3935 — ConnectWise ScreenConnect Improper Authentication Vulnerability art-945
high Understanding command injection vulnerabilities in Go art-1151
crit CISA KEV: CVE-2024-1709 — ConnectWise ScreenConnect Authentication Bypass Vulnerability art-1396
med A day in the life of an ethical hacker art-1697
crit CISA KEV: CVE-2022-36537 — ZK Framework AuUploader Unspecified Vulnerability art-1829
high The security concerns of a JavaScript sandbox with the Node.js VM module art-1832
med New year ushers in new wave of Snyk Technology Alliance Partner Program members art-1864
crit Key points from Google and Accenture's ransomware white paper art-1935
high SREs bring ORDER(R) to CHAOS art-1965
med Cloud security fundamentals part 2: Prevention and secure design art-1972
high Cloud security fundamentals part 1: Know your environment art-1983
med How Onna Technologies uses Snyk & Sysdig to secure the SDLC while saving time and money art-2016
high Cloud Security at Blackhat and Defcon 2022 art-2033
high Securing PHP containers art-2082
crit CISA KEV: CVE-2017-18362 — Kaseya VSA SQL Injection Vulnerability art-2215
med Cloud security challenges art-2247
crit CISA KEV: CVE-2018-20753 — Kaseya VSA Remote Code Execution Vulnerability art-2311
crit Case study: Python RCE vulnerability in Celery art-2614
med 8 best Java code review tools for developers art-2688
high Snyk IaC in 2021: Leading infrastructure as code security for developers art-2718
crit CISA KEV: CVE-2021-30116 — Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability art-2893
crit CISA KEV: CVE-2019-18988 — TeamViewer Desktop Bypass Remote Login Vulnerability art-3023
med Why the Facebook outage and Twitch breach matter to business leaders art-3070
crit Preventing malicious packages and supply chain attacks with Snyk art-3094
high A technical analysis of the Capital One cloud misconfiguration breach art-3495