ABUSING CHROME REMOTE DESKTOP ON RED TEAM OPERATIONS: A PRACTICAL GUIDE

Summary from the TLDR InfoSec newsletter

Red team operators can abuse Chrome Remote Desktop as a legitimate remote access tool by installing the MSI package with admin privileges and using an undocumented `--pin=111111` parameter to bypass GUI PIN setup requirements. The technique leverages Google's infrastructure and HTTPS/WebRTC protocols, making it more difficult to detect than traditional remote access tools, as it appears as legitimate Google traffic. Defenders should implement application allowlisting solutions, such as AppLocker, and monitor for "Chrome Remote Desktop Host" installations to prevent unauthorized remote access deployments.