# T1219 - Remote Access Tools

## SOC Recommendation
Investigate Remote Access Tools activity in the context of Command and Control: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| User Geolocation Logon Pattern Analysis | Detect | Monitor for User Geolocation Logon Pattern Analysis indicators relevant to this technique. |
| Network Traffic Filtering | Isolate | Apply Network Traffic Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Kill the RMM process via MDE Live Response | Low | No | Yes |
| Block the RMM tool's C2 domains/IPs in MDE custom indicators | Medium | No | Yes |
| If deployed by phishing: full GEN-IA-002 investigation | Low | No | Yes |
| Populate ApprovedRMMTools watchlist with authorised tool h | Low | No | Yes |

## KQL
```kql
let RMMTools = dynamic([
    "anydesk.exe",
    "screenconnect.clientservice.exe", "screenconnect.windowsclient.exe",
    "teamviewer.exe", "teamviewer_service.exe", "tv_w32.exe", "tv_x64.exe",
    "atera_agent.exe", "ateraagent.exe",
    "splashtop.exe", "srservice.exe",
    "fleetdeck-agent.exe", "fleetdeck.exe",
    "ninjarmmagent.exe",
    "pdq_agent.exe", "pdqdeployrunner.exe",
    "ultraviewer_desktop.exe",
    "zohoassist.exe",
    "rustdesk.exe",
    "meshagent.exe", "meshcentral.exe"
]);
DeviceProcessEvents
| where TimeGenerated >= ago(15m)
| where FileName in~ (RMMTools)
| where FolderPath !has_any ("Program Files", "ProgramData\\ApprovedRMM")
    or InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "mshta.exe")
| project
    TimeGenerated,
    DeviceName,
    AccountName,
    FileName,
    FolderPath,
    ProcessCommandLine,
    SHA256,
    InitiatingProcessFileName
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = AccountName
| order by TimeGenerated desc
```

## Escalation Criteria
- Remote Access Tools activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- IT team remotely troubleshooting via approved RMM — Add approved tool SHA256 hashes to ApprovedRMMTools watchlist

Generated by SOC Response Atlas by Basyrix.