RemoteAccess
RemoteAccess answers: which remote access tools could reach and control this host - installed or portable - who used them, from where, and what files they moved?
At a glance
Question | Remote access tools intruders use to reach and control a host. |
Reads | A built-in catalog of remote access products and tunnels: their installations, services, programs, folders, configuration and own logs; and Windows' own ways in. |
Parameter |
|
Rule prefix |
|
What it reads
Each product found installed or run portable: identified by its program's version resource, so a renamed copy is still found. Its services, its configuration - its ID, the account or tenant it is enrolled to, its server, unattended access, Safe Mode - and its own logs (
remote_tool).Sessions and transfers from the tools' own logs: incoming sessions with the other side's ID, name and address, their duration, and the files moved (
remote_session,remote_transfer).Windows' own ways in: port forwards, SSH keys the OpenSSH server accepts (by fingerprint), WinRM listeners and settings, Remote Assistance, Remote Desktop shadowing (
remote_setting).The tools' events in the Application and OpenSSH logs (
remote_app_event).
Each tool is joined to Windows Installer's records, process creations, downloads and persistence: when it was installed, how it got there, what keeps it running.
Signals it raises
23 rules: 10 high, 12 medium, 1 low. The full text of each is in the rule catalog.
ID | Severity | Title | Evidence | ATT&CK |
|---|---|---|---|---|
| high | A remote access tool started a command shell or a system tool |
|
|
| high | Files moved through a remote access tool |
|
|
| high | A remote access tool not on the approved list |
|
|
| high | A port forward relays connections through the host |
|
|
| high | A remote access tool ran without being installed |
|
|
| high | A file moved through a remote access tool was then run |
|
|
| high | A remote access tool runs under another file name |
|
|
| high | A remote access tool is set to start in Safe Mode |
|
|
| high | A remote access tool's service runs from a user or temporary folder |
|
|
| high | Remote Desktop sessions can be shadowed without the user's consent |
|
|
| medium | Remote Assistance can be offered without being asked |
|
|
| medium | A remote access tool reports to a server that is not its vendor's |
|
|
| medium | Someone connected to the host through a remote access tool |
|
|
| medium | A remote access tool first seen inside the period |
|
|
| medium | A remote access tool's own log is missing or begins late |
|
|
| medium | A remote access tool was removed after it was used |
|
|
| medium | Several different remote access tools on one host |
|
|
| medium | An SSH key is authorized to sign in |
|
|
| medium | A tunnelling tool is on the host |
|
|
| medium | Unattended access is configured |
|
|
| medium | WinRM accepts unencrypted traffic or Basic authentication |
|
|
| medium | This host's WinRM client trusts every host |
|
|
| low | A remote access tool is on the host |
|
|
How to read it
Approve what you use. Without
approved_tools, Signal cannot know whether a tool is authorised, and RA-NOT-ALLOWED is not run. With it, RA-TOOL-PRESENT leaves out approved products; every other signal about them stays, marked approved - an approved tool is abused too.The tenant matters. TeamViewer enrolled to your company's account is not the same as TeamViewer enrolled to someone else's.
Sessions name the other side: its ID in the product, its name and address. Use them as pivot points across the fleet.
What it can't see
Next
Browsers: what came in through a browser.