Techniques › T1219 › AN1366
AN1366 Analytic 1366
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Chain of remote access tool behavior: (1) initial execution of remote-control/assist agent or GUI under user context; (2) persistence via service or autorun; (3) long-lived outbound connection/tunnel to external infrastructure; (4) interactive control signals such as shell or file-manager child processes spawned by the RAT parent.</p>
- Detects
- T1219 Remote Access Tools
- Part of
- DET0496 Behavior-Chain Detection for Remote Access Tools (Tool-Agnostic)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:System | EventCode=7045 | DC0060 Service Creation |
| WinEventLog:Sysmon | EventCode=12 | DC0056 Windows Registry Key Creation |
| WinEventLog:Sysmon | EventCode=13, 14 | DC0063 Windows Registry Key Modification |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlation period binding start→persistence→egress→child (default 15m, adjust per environment). |
UserContext | Differentiate help-desk/jump hosts and admin accounts from standard endpoints. |
ProcessAllowlist | Known-good remote support tools; suppress expected events while still correlating anomalous sequences. |
InstallPathRegex | Alert when services/agents execute from user-writable or temp paths. |
ExternalIPAllowlist | Vendors’ support clouds/CDNs to reduce false positives on egress detection. |
ShellSpawnRegex | Define which child shells from GUI parents are acceptable versus suspicious. |
EgressHeuristics | Thresholds for session duration, connection counts, and bytes_out/bytes_in ratio. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2018-4878 | Adobe Flash Player | Mapped |