ConnectWise is a legitimate remote administration tool that has been used since at least 2016 by threat actors including MuddyWater and GOLD SOUTHFIELD to connect to and conduct lateral movement in target environments.
| Technique | Procedure example |
|---|---|
| T1059.001 PowerShell |
ConnectWise can be used to execute PowerShell commands on target machines. |
| T1113 Screen Capture |
ConnectWise can take screenshots on remote hosts. |
| T1125 Video Capture |
ConnectWise can record video on remote hosts. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
