Detect Remote Access Tools in IBM QRadar
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software and remote management software allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access. Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1219 Remote Access Tools
- Canonical reference
- https://attack.mitre.org/techniques/T1219/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
logsourcename(logsourceid) AS log_source,
sourceip,
username,
"Process Name",
"Command Line",
"Parent Process Name",
CATEGORYNAME(category) AS event_category,
CASE
WHEN LOWER("Process Name") MATCHES '.*?(teamviewer|anydesk|screenconnect|connectwise).*?' THEN 'Commercial RMM'
WHEN LOWER("Process Name") MATCHES '.*?(vnc|tvnserver|winvnc|uvnc).*?' THEN 'VNC'
WHEN LOWER("Process Name") MATCHES '.*?(logmein|lmi_rescue).*?' THEN 'LogMeIn'
WHEN LOWER("Process Name") MATCHES '.*?(ammyy|aa_v3).*?' THEN 'AmmyyAdmin'
WHEN LOWER("Process Name") MATCHES '.*?(rustdesk|splashtop|supremo).*?' THEN 'Other RMM'
WHEN LOWER("Process Name") MATCHES '.*?(atera|ninja|simplehelp|dwrcs).*?' THEN 'MSP Tool'
ELSE 'Unknown'
END AS rat_category,
CASE
WHEN LOWER("Parent Process Name") MATCHES '.*?(services\.exe|svchost\.exe).*?' THEN 'Yes'
ELSE 'No'
END AS is_service_launched,
CASE
WHEN LOWER("Parent Process Name") MATCHES '.*?(explorer\.exe|cmd\.exe|powershell\.exe).*?' THEN 'Yes'
ELSE 'No'
END AS is_user_launched
FROM events
WHERE
LOGSOURCETYPEID IN (12, 13, 101, 143)
AND QIDNAME(qid) ILIKE '%process%'
AND (
LOWER("Process Name") MATCHES '.*?teamviewer.*?'
OR LOWER("Process Name") MATCHES '.*?anydesk.*?'
OR LOWER("Process Name") MATCHES '.*?screenconnect.*?'
OR LOWER("Process Name") MATCHES '.*?connectwisecontrol.*?'
OR LOWER("Process Name") MATCHES '.*?logmein.*?'
OR LOWER("Process Name") MATCHES '.*?lmi_rescue.*?'
OR LOWER("Process Name") MATCHES '.*?ammyyadmin.*?'
OR LOWER("Process Name") MATCHES '.*?aa_v3\.exe.*?'
OR LOWER("Process Name") MATCHES '.*?supremo.*?'
OR LOWER("Process Name") MATCHES '.*?rustdesk.*?'
OR LOWER("Process Name") MATCHES '.*?splashtop.*?'
OR LOWER("Process Name") MATCHES '.*?ateraagent.*?'
OR LOWER("Process Name") MATCHES '.*?ninjaone.*?'
OR LOWER("Process Name") MATCHES '.*?ninjaremote.*?'
OR LOWER("Process Name") MATCHES '.*?simplehelp.*?'
OR LOWER("Process Name") MATCHES '.*?dwrcs.*?'
OR LOWER("Process Name") MATCHES '.*?dwrcst.*?'
OR LOWER("Process Name") MATCHES '.*?tmate.*?'
OR LOWER("Process Name") MATCHES '.*?tvnserver.*?'
OR LOWER("Process Name") MATCHES '.*?winvnc.*?'
OR LOWER("Process Name") MATCHES '.*?uvnc_service.*?'
OR LOWER("Process Name") IN ('vnc.exe', 'vncviewer.exe')
)
AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LAST 24 HOURSQRadar AQL query detecting process creation events for known Remote Access Tools across Windows endpoints using Sysmon or Windows Security event sources. Normalizes results with RATCategory classification and flags whether the process was service- or user-initiated, enabling triage differentiation between managed RMM deployment and adversary-initiated remote access.
Data Sources
Required Tables
False Positives & Tuning
- Sanctioned MSP agents (Atera, NinjaRMM, ScreenConnect) deployed to managed endpoints as part of a formal IT contract
- Internal IT staff using TeamViewer or AnyDesk for routine remote support tickets
- Developer workstations running tmate for collaborative terminal sharing during code review
Other platforms for T1219
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 AnyDesk Portable Execution from Temp Directory
Expected signal: Sysmon Event ID 1: Process Create with Image=%TEMP%\anydesk_test.exe. Sysmon Event ID 3: Network connection to AnyDesk relay servers (*.net.anydesk.com). Sysmon Event ID 11: File creation in %TEMP% for the AnyDesk binary. Sysmon Event ID 22: DNS query for anydesk.com domains.
- Test 2 TeamViewer Service Installation Detection
Expected signal: Sysmon Event ID 12: Registry key created at HKCU\SOFTWARE\TeamViewer_Test. Sysmon Event ID 13: Registry value set for Run key persistence. Security Event ID 4688: reg.exe process creation with command line containing TeamViewer.
- Test 3 VNC Server Execution Test
Expected signal: Sysmon Event ID 1: Process Create with Image containing tvnserver.exe or cmd.exe (mock). If TightVNC present: Sysmon Event ID 3 for VNC listening on port 5900. Security Event ID 4688 with command line arguments.
References (7)
- https://attack.mitre.org/techniques/T1219/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1219/T1219.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
- https://go.crowdstrike.com/rs/281-OBQ-266/images/15GlobalThreatReport.pdf
- https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ransomware
Response Playbook
Triage
- Verify whether the detected remote access tool is on the organization's approved software list — check the CMDB or software asset inventory for the specific tool and version
- Determine who launched the tool — was it the logged-in user interactively (parent: explorer.exe), a service (parent: services.exe/svchost.exe), or spawned by another process (e.g., PowerShell, cmd.exe, or an Office application)?
- Check if there is an active support ticket or change request that justifies the remote access session at this time
- Examine network connections from the RAT process — use DeviceNetworkEvents or Sysmon Event ID 3 to identify the remote IP and determine if it maps to a known support vendor or an unexpected external address
- Review the installation path — is the tool installed in the standard location (e.g., C:\Program Files\TeamViewer) or a suspicious path (e.g., temp directories, user Desktop, AppData\Roaming)?
- Check for lateral movement indicators — did the same remote access tool appear on multiple endpoints within a short time window?
Containment
- If the tool is unauthorized: immediately terminate the RAT process and quarantine the executable via EDR
- If connecting to a suspicious external IP: block the destination IP/domain at the firewall and proxy, then isolate the endpoint
- If the tool was deployed by malware: isolate the endpoint from the network, disable the user account, and begin malware analysis on the installer/dropper
- If multiple endpoints are affected: create a network-wide block for the RAT binary hash and associated domains, deploy an EDR sweep to identify and kill all instances
- If data exfiltration is suspected: capture a full memory dump before terminating the process, preserve network flow logs for the session duration
Evidence Collection
- Process Creation Events — Sysmon Event ID 1 or Security Event ID 4688 for the RAT process and its parent chain
- Network Connection Events — Sysmon Event ID 3 for all outbound connections from the RAT process, including remote IPs, ports, and connection duration
- DNS Query Events — Sysmon Event ID 22 for domain lookups related to RAT infrastructure (e.g., *.teamviewer.com, *.anydesk.com, relay servers)
- File Creation Events — Sysmon Event ID 11 for the RAT installer/binary and any configuration files written to disk
- Registry Events — Sysmon Event ID 12/13 for persistence keys (Run/RunOnce, services) created by the RAT installer
- Service Installation Events — Security Event ID 7045 for any new services created during RAT installation
- Windows Installer Logs — %TEMP%\MSI*.log if the RAT was installed via MSI package
- RAT-specific logs — TeamViewer: %APPDATA%\TeamViewer\TeamViewer*.log, AnyDesk: %PROGRAMDATA%\AnyDesk\connection_trace.txt, ScreenConnect: installation logs in the ScreenConnect directory
Escalation Criteria
- !Unauthorized remote access tool found on a server or domain controller — this is never expected and indicates likely compromise
- !RAT deployed by a non-interactive process (e.g., spawned by PowerShell, cmd.exe from a scheduled task, or a malware dropper) rather than user interaction
- !Remote access tool connecting to IPs in sanctioned countries or known threat actor infrastructure
- !Multiple endpoints showing the same unauthorized RAT within hours — suggests automated deployment or lateral movement
- !RAT process running under a privileged service account (SYSTEM, domain admin) with no corresponding IT ticket
- !Evidence of file transfer or clipboard exfiltration through the RAT session
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Registry: HKLM\SYSTEM\CurrentControlSet\Services\<RAT_service_name> — service configuration for installed RAT services - >
Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run — auto-start entries added by RAT installers - >
Registry: HKLM\SOFTWARE\TeamViewer — TeamViewer configuration including client ID - >
Registry: HKCU\SOFTWARE\AnyDesk — AnyDesk client configuration and ID - >
File System: %APPDATA%\TeamViewer\TeamViewer15_Logfile.log — TeamViewer session logs with connection timestamps and remote IDs - >
File System: %PROGRAMDATA%\AnyDesk\connection_trace.txt — AnyDesk connection history with timestamps and remote IDs - >
File System: %PROGRAMDATA%\ScreenConnect Client*\ — ScreenConnect client installation and session data - >
Event Log: System Event ID 7045 — new service installation events for RAT services - >
Event Log: Security Event ID 4688 — process creation with command line for RAT execution - >
Prefetch: C:\Windows\Prefetch\<RAT_NAME>.EXE-*.pf — RAT execution timestamps and loaded modules
Tuning Guidance
Begin by inventorying all approved remote access tools in your environment and creating an allowlist of expected binary names, installation paths, and associated service accounts. Suppress alerts for approved tools running from standard paths (C:\Program Files\*) and launched by expected parent processes (services.exe for installed services, explorer.exe for user-initiated sessions). For MSP-managed environments, create exceptions for the specific MSP's RMM agent (e.g., Atera, NinjaOne) running as its designated service account. Focus detection effort on: (1) RAT binaries in non-standard locations, (2) RATs not on the approved list, (3) RATs launched by unexpected parent processes (PowerShell, cmd.exe from scheduled tasks, Office applications), and (4) RAT network connections to unexpected destinations. Consider implementing application control (AppLocker, WDAC) to block unauthorized RAT executables proactively.
Hunting Queries
Hunt for remote access tools with high-volume outbound network activity to public IPs. Excessive connections or multiple unique remote IPs may indicate sustained C2 sessions, data exfiltration, or a tool being used across multiple compromised endpoints as relay infrastructure.
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName has_any ("teamviewer", "anydesk", "screenconnect", "connectwise", "logmein", "ammyy", "rustdesk", "splashtop", "supremo")
| where RemoteIPType == "Public"
| summarize TotalConnections=count(), UniqueRemoteIPs=dcount(RemoteIP), AvgBytesOut=avg(SentBytes), Devices=dcount(DeviceName) by InitiatingProcessFileName, RemotePort
| where TotalConnections > 10 or UniqueRemoteIPs > 3
| sort by TotalConnections descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
(Image="*\\teamviewer*" OR Image="*\\anydesk*" OR Image="*\\screenconnect*" OR Image="*\\connectwise*" OR Image="*\\logmein*" OR Image="*\\ammyy*" OR Image="*\\rustdesk*" OR Image="*\\splashtop*" OR Image="*\\supremo*")
NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="192.168.*" OR DestinationIp="127.*")
| stats count as TotalConnections, dc(DestinationIp) as UniqueRemoteIPs, dc(host) as Devices by Image, DestinationPort
| where TotalConnections > 10 OR UniqueRemoteIPs > 3
| sort - TotalConnectionsHunt for remote access tool binaries being dropped outside standard installation directories. RAT executables appearing in temp folders, user profiles, or AppData may indicate portable/standalone deployments used by adversaries to avoid detection by application control policies.
DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName has_any ("teamviewer", "anydesk", "screenconnect", "connectwise", "ammyyadmin", "rustdesk", "splashtop", "supremo", "atera", "simplehelp", "dwrcs")
| where ActionType == "FileCreated"
| where FolderPath !startswith "C:\\Program Files" and FolderPath !startswith "C:\\Program Files (x86)"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*teamviewer*" OR TargetFilename="*anydesk*" OR TargetFilename="*screenconnect*" OR TargetFilename="*connectwise*" OR TargetFilename="*ammyyadmin*" OR TargetFilename="*rustdesk*" OR TargetFilename="*splashtop*" OR TargetFilename="*supremo*" OR TargetFilename="*atera*" OR TargetFilename="*simplehelp*" OR TargetFilename="*dwrcs*")
NOT (TargetFilename="C:\\Program Files*")
| table _time, host, User, TargetFilename, Image
| sort - _timeHunt for remote access tools establishing persistence via Run/RunOnce registry keys or Windows services. RAT persistence entries created outside of normal software installation workflows (e.g., not by msiexec.exe or a known installer) are strong indicators of adversary activity.
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has_any ("Run", "RunOnce") or RegistryKey contains "Services"
| where RegistryValueData has_any ("teamviewer", "anydesk", "screenconnect", "connectwise", "logmein", "ammyy", "rustdesk", "splashtop", "supremo", "atera", "simplehelp", "dwrcs")
| project Timestamp, DeviceName, AccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=12 OR EventCode=13 OR EventCode=14)
(TargetObject="*\\Run\\*" OR TargetObject="*\\RunOnce\\*" OR TargetObject="*\\Services\\*")
(Details="*teamviewer*" OR Details="*anydesk*" OR Details="*screenconnect*" OR Details="*connectwise*" OR Details="*logmein*" OR Details="*ammyy*" OR Details="*rustdesk*" OR Details="*splashtop*" OR Details="*supremo*" OR Details="*atera*" OR Details="*simplehelp*" OR Details="*dwrcs*")
| table _time, host, User, EventCode, TargetObject, Details, Image
| sort - _timeAtomic Red Team Tests
Downloads and executes AnyDesk in portable mode from a temp directory, simulating how adversaries deploy RATs without installation. The --get-id flag retrieves the AnyDesk address without establishing a connection, making this safe for testing while still generating process creation and network telemetry.
Command
curl.exe -o %TEMP%\anydesk_test.exe https://download.anydesk.com/AnyDesk.exe && %TEMP%\anydesk_test.exe --get-idCleanup
taskkill /F /IM anydesk_test.exe 2>nul & del /F %TEMP%\anydesk_test.exe 2>nulExpected Telemetry
Sysmon Event ID 1: Process Create with Image=%TEMP%\anydesk_test.exe. Sysmon Event ID 3: Network connection to AnyDesk relay servers (*.net.anydesk.com). Sysmon Event ID 11: File creation in %TEMP% for the AnyDesk binary. Sysmon Event ID 22: DNS query for anydesk.com domains.
Expected Detection
Alert fires on anydesk.exe process name. KQL: RATCategory='Commercial RMM'. SPL: RATCategory='Commercial RMM'. Hunting query for non-standard installation path triggers (binary in %TEMP% instead of Program Files).
Simulates the registry footprint of a TeamViewer installation by creating a mock registry key under the TeamViewer path. This tests detection of RAT persistence without requiring actual TeamViewer installation.
Command
reg add "HKCU\SOFTWARE\TeamViewer_Test" /v ClientID /t REG_SZ /d "123456789" /f && reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v TeamViewerTest /t REG_SZ /d "C:\Temp\teamviewer_test.exe" /fCleanup
reg delete "HKCU\SOFTWARE\TeamViewer_Test" /f 2>nul & reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v TeamViewerTest /f 2>nulExpected Telemetry
Sysmon Event ID 12: Registry key created at HKCU\SOFTWARE\TeamViewer_Test. Sysmon Event ID 13: Registry value set for Run key persistence. Security Event ID 4688: reg.exe process creation with command line containing TeamViewer.
Expected Detection
Hunting query for RAT persistence via registry fires on the Run key entry containing 'teamviewer'. SPL/KQL registry hunting queries detect the persistence mechanism.
Starts a TightVNC server in service mode with a test password, simulating adversary deployment of VNC for remote access. The server is started and immediately stopped for safe testing.
Command
powershell.exe -Command "if (Test-Path 'C:\Program Files\TightVNC\tvnserver.exe') { Start-Process 'C:\Program Files\TightVNC\tvnserver.exe' -ArgumentList '-controlservice -show' -Wait -NoNewWindow } else { Write-Output 'TightVNC not installed - creating mock process event'; Start-Process cmd.exe -ArgumentList '/c echo tvnserver mock test' -Wait -NoNewWindow }"Cleanup
taskkill /F /IM tvnserver.exe 2>nulExpected Telemetry
Sysmon Event ID 1: Process Create with Image containing tvnserver.exe or cmd.exe (mock). If TightVNC present: Sysmon Event ID 3 for VNC listening on port 5900. Security Event ID 4688 with command line arguments.
Expected Detection
Alert fires on tvnserver.exe process name. KQL: RATCategory='VNC'. SPL: RATCategory='VNC'. Network hunting query detects VNC listening on port 5900.