An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy)

Remote access software may be installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary-controlled system.
 
Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Installation of many remote access software may also include persistence (e.g., the software's installation routine creates a [Windows Service](https://attack.mitre.org/techniques/T1543/003)). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
Remote Access Software
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1219  external_id: T1219     source_name: CrowdStrike 2015 Global Threat Report  description: CrowdStrike Intelligence. (2016). 2015 Global Threat Report. Retrieved April 11, 2018.  url: https://go.crowdstrike.com/rs/281-OBQ-266/images/15GlobalThreatReport.pdf     source_name: CrySyS Blog TeamSpy  description: CrySyS Lab. (2013, March 20). TeamSpy – Obshie manevri. Ispolzovat’ tolko s razreshenija S-a. Retrieved April 11, 2018.  url: https://blog.crysys.hu/2013/03/teamspy/     source_name: Google Chrome Remote Desktop  description: Google. (n.d.). Retrieved March 14, 2024.  url: https://support.google.com/chrome/answer/1649523     source_name: Chrome Remote Desktop  description: Huntress. (n.d.). Retrieved March 14, 2024.  url: https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708     source_name: Symantec Living off the Land  description: Wueest, C., Anand, H. (2017, July). Living off the land and fileless attack techniques. Retrieved April 10, 2018.  url: https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/istr-living-off-the-land-and-fileless-attack-techniques-en.pdf     