Description
This detector identifies situations where the device used to access the application is being controlled or viewed remotely by another system or operator. In these cases, user input such as screen rendering, mouse movement, or keyboard activity is relayed over a network connection rather than generated locally at the physical device.
Remote-controlled environments expose technical characteristics that differ from direct, local interaction. Detection focuses on indicators that suggest the presence of remote access software or intermediary control layers, including
Remote desktop and VNC artifacts
Identification of display drivers, session behaviors, or network patterns commonly associated with remote access protocols such as RDP or VNC.
Display flag and driver mismatches
The browser reports the presence of a virtual display, mirror driver, or non-physical monitor rather than a display connected via standard physical interfaces such as HDMI or DisplayPort.
Input latency and interaction jitter
Subtle, millisecond-level delays and inconsistencies in mouse movement and keyboard input that are characteristic of human interaction transmitted over a remote network connection.
Relevance to Social Engineering Attacks
In advanced social engineering campaigns, remote control is frequently used as a bridging technique to defeat location-based, device-based, and reputation-based security controls.
Common attacker strategies include:
Remote bridge operations using accomplice hosts
An attacker operating from one country remotely controls a physical laptop located in another region, often maintained by an accomplice or a hosting farm. Because the device is physically present in the expected city and uses a residential network, it passes most traditional location and device trust checks. Detection of the remote control layer is often the only reliable way to expose this setup.
Bypassing hardware trust signals
By operating through a real, clean physical machine, attackers avoid triggering detections related to virtual machines or anomalous hardware profiles. While the device appears legitimate, the individual controlling it is geographically distant and unaffiliated with the trusted user.
Reinforcing social engineering pretexts
During help desk or support calls, attackers may claim to be working from their home or office network. IP address and geolocation data may fully support this claim. Detection of an active remote control session reveals the discrepancy between the person speaking and the person physically interacting with the device.
Examples of Detected Tooling and Techniques
This detector is effective against a range of remote access technologies, including:
Commercial remote access software
AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop.
Native operating system remote access tools
Microsoft Remote Desktop Protocol (RDP), Apple Screen Sharing (VNC).
Stealth or covert remote control implementations
Specialized VNC variants or shadow remote access tools designed to operate without visible indicators to the local user.