What is a remote-access tool?¶
A remote-access tool is software or a service that allows one device or user to control, view or administer another system from a different location.
Avoid the dangerous assumption¶
The dangerous assumption is that the presence of remote-access software proves malicious use.
It does not.
Remote access is widely used for legitimate administration, technical support, home working and managed services.
The investigative question is whether the tool was authorised, how it was configured and what activity occurred through it.
A remote-access tool may allow:
- screen viewing
- keyboard and mouse control
- file transfer
- command execution
- software installation
- session recording
- persistent unattended access.
Relevant evidence may include:
- installation records
- account identifiers
- session logs
- connection times
- source addresses
- device names
- configuration
- file-transfer history
- chat records
- recorded sessions
- licensing or subscription details.
Ask who installed the tool, who approved it, which accounts could use it and whether unattended access was enabled.
Do not assume the named account identifies the person controlling the session. Accounts may be shared, compromised or used through another service.
Also distinguish the existence of the tool from evidence of use. Software may be installed but inactive.
Likewise, a connection record may show that a session was established without proving every available function was used.
Remote-access evidence may explain how activity occurred on a device while the owner was elsewhere.
It may also weaken a simple inference that physical possession of the device proves personal responsibility for actions performed on it.
Operational takeaway¶
Establish whether the remote-access tool was authorised, who could use it and what the session records show before treating its presence as evidence of malicious control.