Remote access software
Remote access software enables a person or service to interact with a computer from another location, including viewing or controlling its desktop or performing remote administration.
Legitimate software still needs an authorized operator
Support teams use remote tools to troubleshoot problems, install software, and manage systems. MITRE documents how attackers can abuse the same capabilities for interactive access. Recognizing the tool does not tell you whether the person using it has permission.
Capabilities depend on the product, configuration, and permissions. A session might allow screen viewing, keyboard control, file transfers, or administration. Check which permissions it actually had and which actions took place.
An unexpected support call is a reason to verify the request through your normal IT channel before granting access. Starting the application, allowing screen viewing, and allowing control can be separate steps. Investigators need to establish which access was granted.
Approving and investigating remote sessions
Maintain an inventory of approved remote tools and their owners. MITRE recommends limiting unnecessary remote functionality and using application controls to restrict unapproved software. Ask the support owner how sessions are authorized, what access they permit, and which records are available.
When investigating a session, match it to the support request, device, timing, and recorded actions. Identify the operator where the records allow it. The fake IT remote-support article explains how to trace a call through to an established session.