Command and Control

T1219 — Remote Access Tools

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions...

Investigate Remote Access Tools activity in the context of Command and Control: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

Platforms

Linux, macOS, Windows

Priority / status

high / complete

Evidence to collect

Host or resource affected
Account or identity involved
Timestamp of the activity
Related process, file, or network artifact
Any preceding or follow-on alerts

ATT&CK Technique	D3FEND Technique	Practical SOC Action	Tooling
T1219 Remote Access Tools	User Geolocation Logon Pattern Analysis	Monitor for User Geolocation Logon Pattern Analysis indicators relevant to this technique.	Defender for Endpoint
T1219 Remote Access Tools	Network Traffic Filtering	Apply Network Traffic Filtering to contain the blast radius once this technique is observed.	Sentinel, Defender for Endpoint

T1219 Remote Access Tools → D3FEND → SOC action

Investigation steps — Microsoft

Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
Check Sentinel analytics rules and incidents correlated with this technique.
Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

Investigation steps — generic

Confirm whether the observed remote access tools activity matches expected administrative or application behaviour.
Identify the host, account, or resource where the activity occurred and its business criticality.
Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.
Real detection reference: "Unapproved RMM Tool Execution" -- Flags execution of a legitimate remote access / RMM tool (AnyDesk, ScreenConnect, TeamViewer, Atera, Splashtop, RustDesk, MeshCentral, etc.) launched from a suspicious parent or a non-standard install path.

Response actions

Action	Risk	Automation safe	Approval required
Kill the RMM process via MDE Live Response	Low	No	Yes
Block the RMM tool's C2 domains/IPs in MDE custom indicators	Medium	No	Yes
If deployed by phishing: full GEN-IA-002 investigation	Low	No	Yes
Populate ApprovedRMMTools watchlist with authorised tool h	Low	No	Yes

KQL

GEN-CC-003 — Unapproved RMM Tool Execution

let RMMTools = dynamic([
    "anydesk.exe",
    "screenconnect.clientservice.exe", "screenconnect.windowsclient.exe",
    "teamviewer.exe", "teamviewer_service.exe", "tv_w32.exe", "tv_x64.exe",
    "atera_agent.exe", "ateraagent.exe",
    "splashtop.exe", "srservice.exe",
    "fleetdeck-agent.exe", "fleetdeck.exe",
    "ninjarmmagent.exe",
    "pdq_agent.exe", "pdqdeployrunner.exe",
    "ultraviewer_desktop.exe",
    "zohoassist.exe",
    "rustdesk.exe",
    "meshagent.exe", "meshcentral.exe"
]);
DeviceProcessEvents
| where TimeGenerated >= ago(15m)
| where FileName in~ (RMMTools)
| where FolderPath !has_any ("Program Files", "ProgramData\\ApprovedRMM")
    or InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "mshta.exe")
| project
    TimeGenerated,
    DeviceName,
    AccountName,
    FileName,
    FolderPath,
    ProcessCommandLine,
    SHA256,
    InitiatingProcessFileName
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = AccountName
| order by TimeGenerated desc

Escalation criteria

Remote Access Tools activity observed on a privileged account or critical system.
Activity follows or precedes other suspicious behaviour in the same investigation.
Automated triage cannot confidently rule out malicious intent.

False positive considerations

IT team remotely troubleshooting via approved RMM — Add approved tool SHA256 hashes to ApprovedRMMTools watchlist

View Markdown Download Markdown

# T1219 - Remote Access Tools

## SOC Recommendation
Investigate Remote Access Tools activity in the context of Command and Control: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| User Geolocation Logon Pattern Analysis | Detect | Monitor for User Geolocation Logon Pattern Analysis indicators relevant to this technique. |
| Network Traffic Filtering | Isolate | Apply Network Traffic Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Kill the RMM process via MDE Live Response | Low | No | Yes |
| Block the RMM tool's C2 domains/IPs in MDE custom indicators | Medium | No | Yes |
| If deployed by phishing: full GEN-IA-002 investigation | Low | No | Yes |
| Populate ApprovedRMMTools watchlist with authorised tool h | Low | No | Yes |

## KQL
```kql
let RMMTools = dynamic([
    "anydesk.exe",
    "screenconnect.clientservice.exe", "screenconnect.windowsclient.exe",
    "teamviewer.exe", "teamviewer_service.exe", "tv_w32.exe", "tv_x64.exe",
    "atera_agent.exe", "ateraagent.exe",
    "splashtop.exe", "srservice.exe",
    "fleetdeck-agent.exe", "fleetdeck.exe",
    "ninjarmmagent.exe",
    "pdq_agent.exe", "pdqdeployrunner.exe",
    "ultraviewer_desktop.exe",
    "zohoassist.exe",
    "rustdesk.exe",
    "meshagent.exe", "meshcentral.exe"
]);
DeviceProcessEvents
| where TimeGenerated >= ago(15m)
| where FileName in~ (RMMTools)
| where FolderPath !has_any ("Program Files", "ProgramData\\ApprovedRMM")
    or InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "mshta.exe")
| project
    TimeGenerated,
    DeviceName,
    AccountName,
    FileName,
    FolderPath,
    ProcessCommandLine,
    SHA256,
    InitiatingProcessFileName
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = AccountName
| order by TimeGenerated desc
```

## Escalation Criteria
- Remote Access Tools activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- IT team remotely troubleshooting via approved RMM — Add approved tool SHA256 hashes to ApprovedRMMTools watchlist

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1219.json

Response:

{
  "technique_id": "T1219",
  "name": "Remote Access Tools",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Command and Control"
  ],
  "platforms": [
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions...",
  "soc_recommendation": "Investigate Remote Access Tools activity in the context of Command and Control: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-UGLPA",
      "name": "User Geolocation Logon Pattern Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for User Geolocation Logon Pattern Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-NTF",
      "name": "Network Traffic Filtering",
      "relationship": "isolate",
      "practical_action": "Apply Network Traffic Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed remote access tools activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Unapproved RMM Tool Execution\" -- Flags execution of a legitimate remote access / RMM tool (AnyDesk, ScreenConnect, TeamViewer, Atera, Splashtop, RustDesk, MeshCentral, etc.) launched from a suspicious parent or a non-standard install path."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Kill the RMM process via MDE Live Response",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint"
    },
    {
      "name": "Block the RMM tool's C2 domains/IPs in MDE custom indicators",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint"
    },
    {
      "name": "If deployed by phishing: full GEN-IA-002 investigation",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Populate ApprovedRMMTools watchlist with authorised tool h",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Populate ApprovedRMMTools watchlist with authorised tool hashes for future baseline"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-CC-003 — Unapproved RMM Tool Execution",
        "description": "Flags execution of a legitimate remote access / RMM tool (AnyDesk, ScreenConnect, TeamViewer, Atera, Splashtop, RustDesk, MeshCentral, etc.) launched from a suspicious parent or a non-standard install path. (Source: Bell Integration baseline detection library.)",
        "query": "let RMMTools = dynamic([\n    \"anydesk.exe\",\n    \"screenconnect.clientservice.exe\", \"screenconnect.windowsclient.exe\",\n    \"teamviewer.exe\", \"teamviewer_service.exe\", \"tv_w32.exe\", \"tv_x64.exe\",\n    \"atera_agent.exe\", \"ateraagent.exe\",\n    \"splashtop.exe\", \"srservice.exe\",\n    \"fleetdeck-agent.exe\", \"fleetdeck.exe\",\n    \"ninjarmmagent.exe\",\n    \"pdq_agent.exe\", \"pdqdeployrunner.exe\",\n    \"ultraviewer_desktop.exe\",\n    \"zohoassist.exe\",\n    \"rustdesk.exe\",\n    \"meshagent.exe\", \"meshcentral.exe\"\n]);\nDeviceProcessEvents\n| where TimeGenerated >= ago(15m)\n| where FileName in~ (RMMTools)\n| where FolderPath !has_any (\"Program Files\", \"ProgramData\\\\ApprovedRMM\")\n    or InitiatingProcessFileName in~ (\"cmd.exe\", \"powershell.exe\", \"wscript.exe\", \"mshta.exe\")\n| project\n    TimeGenerated,\n    DeviceName,\n    AccountName,\n    FileName,\n    FolderPath,\n    ProcessCommandLine,\n    SHA256,\n    InitiatingProcessFileName\n| extend timestamp = TimeGenerated,\n         HostCustomEntity = DeviceName,\n         AccountCustomEntity = AccountName\n| order by TimeGenerated desc"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "a8b2c4d6-e8f0-12a4-b6c8-d0e2f4a6b8c0 — Newly Observed ScreenConnect Host Server",
        "description": "(ESQL) Detects when the ScreenConnect client (ConnectWise Control) connects to a newly observed host server that is not the official ScreenConnect cloud. ScreenConnect is a common RMM/remote access tool abused for C2 and persistence. Self-hosted or non-standard relay servers may indicate abuse or compromise... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from logs-endpoint.events.process-*\n| where event.category == \"process\" and event.type == \"start\" and (process.name == \"ScreenConnect.ClientService.exe\" or process.code_signature.subject_name == \"ConnectWise, LLC\")\n| grok process.command_line \"\"\"e=Access&y=Guest&h=(?<Esql.screenconnect_server>[^&]+)&p\"\"\"\n| where Esql.screenconnect_server is not null and not Esql.screenconnect_server like \"*.screenconnect.com\"\n| stats Esql.count_distinct_host_id = count_distinct(host.id),\n        Esql.first_time_seen = min(@timestamp),\n        Esql.user_name_values = values(user.name),\n        Esql.command_line_values = values(process.command_line),\n        Esql.host_id_values = values(host.id),\n        Esql.host_name_values = values(host.name),\n        Esql.process_entity_id_values = values(process.entity_id) by Esql.screenconnect_server\n| eval Esql.recent = date_diff(\"minute\", Esql.first_time_seen, now())\n| where Esql.recent <= 6 and Esql.count_distinct_host_id == 1\n| eval host.id = mv_first(Esql.host_id_values),\n       host.name = mv_first(Esql.host_name_values),\n       process.command_line = mv_first(Esql.command_line_values),\n       process.entity_id = mv_first(Esql.process_entity_id_values)\n| keep host.id, host.name, process.command_line, process.entity_id, Esql.screenconnect_server, Esql.user_name_values, Esql.first_time_seen"
      },
      {
        "name": "e5f6a7b8-c9d0-8e1f-2a3b-4c5d6e7f8a9b — First Time Seen DNS Query to RMM Domain",
        "description": "(ESQL) Detects DNS queries to commonly abused remote monitoring and management (RMM) or remote access software domains from processes that are not browsers. Intended to surface RMM clients, scripts, or other non-browser activity contacting these services. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "FROM logs-endpoint.events.network-*, logs-windows.sysmon_operational-* METADATA _index\n| WHERE host.os.type == \"windows\"\n    AND event.category == \"network\"\n    AND event.action in (\"lookup_requested\", \"DNSEvent (DNS query)\")\n    AND dns.question.name IS NOT NULL\n\n// Exclude browser processes\n| WHERE NOT\n    process.name IN (\n        \"chrome.exe\", \"msedge.exe\", \"MicrosoftEdge.exe\", \"MicrosoftEdgeCP.exe\",\n        \"firefox.exe\", \"iexplore.exe\", \"safari.exe\", \"brave.exe\",\n        \"opera.exe\", \"vivaldi.exe\", \"msedgewebview2.exe\"\n    )\n\n// Extract the parent domain (last two labels, e.g. example.com)\n| GROK dns.question.name \"\"\"(?:[^.]+\\.)+(?<parent_domain>[^.]+\\.[^.]+)$\"\"\"\n| EVAL parent_domain = COALESCE(parent_domain, dns.question.name)\n\n// Known RMM parent domains, add or remove entries here as your environment changes.\n| WHERE parent_domain IN (\n    \"01com.com\",\n    \"247ithelp.com\",\n    \"action1.com\",\n    \"addigy.com\",\n    \"aeroadmin.com\",\n    \"ammyy.com\",\n    \"anydesk.com\",\n    \"anyplace-control.com\",\n    \"anysupport.net\",\n    \"atera.com\",\n    \"aurelius.host\",\n    \"auvik.com\",\n    \"aweray.com\",\n    \"aweray.net\",\n    \"backdrop.cloud\",\n    \"barracudamsp.com\",\n    \"beamyourscreen.com\",\n    \"beanywhere.com\",\n    \"beinsync.com\",\n    \"beinsync.net\",\n    \"beyondtrustcloud.com\",\n    \"bomgar.com\",\n    \"bomgarcloud.com\",\n    \"centrastage.net\",\n    \"centuriontech.com\",\n    \"connectwise.com\",\n    \"crossloop.com\",\n    \"dameware.com\",\n    \"datto.com\",\n    \"datto.net\",\n    \"deskday.ai\",\n    \"deskroll.com\",\n    \"desktopstreaming.com\",\n    \"distantdesktop.com\",\n    \"donkz.nl\",\n    \"dwservice.net\",\n    \"ehorus.com\",\n    \"electric.ai\",\n    \"emcosoftware.com\",\n    \"ericom.com\",\n    \"fastsupport.com\",\n    \"fastviewer.com\",\n    \"fixme.it\",\n    \"fleetdeck.io\",\n    \"gatherplace.com\",\n    \"gatherplace.net\",\n    \"getgo.com\",\n    \"getscreen.me\",\n    \"gotoassist.at\",\n    \"gotoassist.com\",\n    \"gotoassist.me\",\n    \"gotohttp.com\",\n    \"gotoresolve.com\",\n    \"goverlan.com\",\n    \"heartbeatrm.com\",\n    \"helpme.net\",\n    \"helpwire.app\",\n    \"hoptodesk.com\",\n    \"hostedrmm.com\",\n    \"immy.bot\",\n    \"immybot.com\",\n    \"imperosoftware.com\",\n    \"instanthousecall.com\",\n    \"instanthousecall.net\",\n    \"intelliadmin.com\",\n    \"internapcdn.net\",\n    \"internetid.ru\",\n    \"iperius-rs.com\",\n    \"iperius.net\",\n    \"iperiusremote.com\",\n    \"islonline.com\",\n    \"islonline.net\",\n    \"itarian.com\",\n    \"itsupport247.net\",\n    \"jumpcloud.com\",\n    \"jumpdesktop.com\",\n    \"jumpto.me\",\n    \"kabuto.io\",\n    \"kabutoservices.com\",\n    \"kaseya.com\",\n    \"kaseya.net\",\n    \"kickidler.com\",\n    \"laplink.com\",\n    \"level.io\",\n    \"liongard.com\",\n    \"litemanager.com\",\n    \"litemanager.ru\",\n    \"logicnow.com\",\n    \"logmein-gateway.com\",\n    \"logmein.com\",\n    \"logmeininc.com\",\n    \"logmeinrescue.com\",\n    \"logmeinrescue.eu\",\n    \"lunixar.com\",\n    \"meshcentral.com\",\n    \"mikogo.com\",\n    \"mikogo4.com\",\n    \"miradore.com\",\n    \"msp360.com\",\n    \"mygreenpc.com\",\n    \"n-able.com\",\n    \"naverisk.com\",\n    \"nchuser.com\",\n    \"netop.com\",\n    \"netsupportmanager.com\",\n    \"netsupportsoftware.com\",\n    \"netviewer.com\",\n    \"ninjaone.com\",\n    \"ninjarmm.com\",\n    \"ninjarmm.net\",\n    \"nomachine.com\",\n    \"ntrsupport.com\",\n    \"opti-tune.com\",\n    \"optitune.us\",\n    \"oray.com\",\n    \"oray.net\",\n    \"panorama9.com\",\n    \"parsec.app\",\n    \"parsecusercontent.com\",\n    \"pcvisit.de\",\n    \"pilixo.com\",\n    \"playanext.com\",\n    \"pulseway.com\",\n    \"qetqo.com\",\n    \"r-hud.net\",\n    \"real-time-collaboration.com\",\n    \"remmon.hu\",\n    \"remote.it\",\n    \"remote.management\",\n    \"remotecall.com\",\n    \"remotedesktop.com\",\n    \"remotepc.com\",\n    \"remotetopc.com\",\n    \"remoteutilities.com\",\n    \"remotix.com\",\n    \"remotly.com\",\n    \"repairshopr.com\",\n    \"rmansys.ru\",\n    \"rmmservice.ca\",\n    \"rmmservice.eu\",\n    \"royalapps.com\",\n    \"rport.io\",\n    \"rudesktop.ru\",\n    \"rustdesk.com\",\n    \"rview.com\",\n    \"screenconnect.com\",\n    \"screenmeet.com\",\n    \"scrn.mt\",\n    \"servably.com\",\n    \"server-eye.de\",\n    \"set.me\",\n    \"setme.net\",\n    \"showmypc.com\",\n    \"signalserver.xyz\",\n    \"simple-help.com\",\n    \"skyfex.com\",\n    \"sorillus.com\",\n    \"splashtop.com\",\n    \"splashtop.eu\",\n    \"spyanywhere.com\",\n    \"spytech-web.com\",\n    \"startsupport.com\",\n    \"superops.ai\",\n    \"superops.com\",\n    \"superopsalpha.com\",\n    \"superopsbeta.com\",\n    \"supremocontrol.com\",\n    \"swi-rc.com\",\n    \"swi-tc.com\",\n    \"syncroapi.com\",\n    \"syncromsp.com\",\n    \"syspectr.com\",\n    \"system-monitor.com\",\n    \"systemmonitor.us\",\n    \"tacticalrmm.com\",\n    \"tailscale.com\",\n    \"teamviewer.com\",\n    \"techinline.net\",\n    \"tele-desk.com\",\n    \"tiflux.com\",\n    \"tightvnc.com\",\n    \"tmate.io\",\n    \"todesk.com\",\n    \"twingate.com\",\n    \"ultraviewer.net\",\n    \"ultravnc.com\",\n    \"vnc.com\",\n    \"weezo.me\",\n    \"weezo.net\",\n    \"xeox.com\",\n    \"zoho.eu\",\n    \"zohoassist.com\",\n    \"zohoassist.jp\"\n)\n\n// Aggregate by parent domain and get 1st time seen timestamp as well as unique count of agents\n| STATS\n    event_count = COUNT(*),\n    Esql.first_time_seen = MIN(@timestamp),\n    Esql.count_distinct_host_id = COUNT_DISTINCT(host.id),\n    Esql.process_executable_values = VALUES(process.executable),\n    Esql.dns_question_name_values = VALUES(dns.question.name),\n    Esql.host_name_values = VALUES(host.name),\n    Esql.host_id_values = VALUES(host.id),\n    Esql.user_name_values = VALUES(user.name),\n    Esql.user_id_values = VALUES(user.id),\n    Esql.namespace_values = VALUES(data_stream.namespace) BY parent_domain\n\n// Calculate the time difference between first time seen and rule execution time\n| eval Esql.recent = DATE_DIFF(\"minute\", Esql.first_time_seen, now())\n\n// First time seen is within 6m of the rule execution time and first seen in the last 5 days as per the rule from schedule and limited to 1 unique host\n| where Esql.recent <= 6 and Esql.count_distinct_host_id == 1\n\n// populate fields for rule exception and triage\n| eval host.name = MV_FIRST(Esql.host_name_values),\n       host.id = MV_FIRST(Esql.host_id_values),\n       user.name = MV_FIRST(Esql.user_name_values),\n       user.id = MV_FIRST(Esql.user_id_values),\n       data_stream.namespace = MV_FIRST(Esql.namespace_values),\n       process.executable = MV_FIRST(Esql.process_executable_values),\n       dns.question.name = MV_FIRST(Esql.dns_question_name_values)\n| keep host.name, host.id, user.name, user.id, data_stream.namespace, process.executable, dns.question.name, Esql.*"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Remote Access Tools activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "IT team remotely troubleshooting via approved RMM — Add approved tool SHA256 hashes to ApprovedRMMTools watchlist"
  ],
  "confluence": {
    "title": "T1219 - Remote Access Tools Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}