Find sigma rule 
Attack: Remote Access Software
An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as VNC, Team Viewer, AnyDesk, ScreenConnect, LogMein, AmmyyAdmin, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy)
Remote access software may be installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary-controlled system.
Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
Installation of many remote access software may also include persistence (e.g., the software’s installation routine creates a Windows Service). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
MITRE
Tactic
- command-and-control
technique
- T1219
Test : NetSupport - RAT Execution
OS
- windows
Description:
A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as NetSupport to provide the operator with access to the network using legitimate services.
Executor
powershell
Sigma Rule
-
proc_creation_win_renamed_netsupport_rat.yml (id: 0afbd410-de03-4078-8491-f132303cb67d)
-
proc_creation_win_remote_access_tools_netsupport_susp_exec.yml (id: 37e8d358-6408-4853-82f4-98333fca7014)
-
proc_creation_win_remote_access_tools_netsupport.yml (id: 758ff488-18d5-4cbe-8ec4-02b6285a434f)