Listen to this Post
Introduction:
Living Off the Land Remote Monitoring and Management (LOLRMM) refers to the use of legitimate administrative tools—such as remote monitoring software—by attackers to maintain covert access, blend into normal traffic, and bypass traditional security controls. The recent addition of “Net Monitor for Employees” to the MagicSword LOLRMM project highlights how a tool designed for internal employee oversight can be repurposed as a stealthy backdoor, offering full remote visibility and control without raising immediate red flags.
Learning Objectives:
- Understand the concept of LOLRMM and why legitimate RMM tools pose a detection challenge.
- Learn specific Windows commands, PowerShell scripts, and Sysmon configurations to detect Net Monitor for Employees activity.
- Implement network-level and endpoint hardening measures to mitigate abuse of RMM tools in your environment.
You Should Know:
- What Is Net Monitor for Employees and Why It Belongs in LOLRMM
Net Monitor for Employees is marketed as a legitimate solution for tracking employee activity, capturing screenshots, logging keystrokes, and remotely accessing desktops. Like many RMM agents, it installs a background service, communicates over standard HTTP/HTTPS ports, and can be silently deployed. Its inclusion in LOLRMM is critical because attackers can abuse it for post‑exploitation persistence, data exfiltration, and lateral movement—all under the guise of normal IT administration.
Step‑by‑step guide to identifying the tool’s artifacts on Windows:
1. Check for running processes (cmd as admin):
tasklist | findstr /i "netmonitor employee" wmic process where "name like '%netmonitor%'" get name,processid,executablepath
2. List installed services (PowerShell):
Get-Service | Where-Object {$<em>.DisplayName -like "Net Monitor" -or $</em>.Name -like "NME"}
3. Search for known installation paths (common directories):
dir "C:\Program Files\Net Monitor for Employees" /s dir "%ProgramFiles(x86)%\Net Monitor" /s
4. Query registry for persistence:
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /s | findstr /i "netmonitor" reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s | findstr /i "netmonitor"
2. Detecting RMM Communication via Network Monitoring
Most RMM tools, including Net Monitor for Employees, use outbound HTTPS connections to a command‑and‑control (C2) server. Unlike malware, these connections use legitimate certificates and domains, but anomaly detection can still uncover them.
Step‑by‑step guide to capture and analyze suspicious RMM traffic:
- Use `netstat` to identify established connections from unexpected processes:
netstat -ano | findstr "ESTABLISHED" | findstr /i "443" tasklist /fi "PID eq [bash]" (replace [bash] with the process ID from netstat)
-
Enable advanced audit logging via PowerShell to monitor outbound connections:
Enable PowerShell transcription and module logging Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1 Enable command line auditing auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable
-
Use Sysmon (Event ID 3 for network connections) – Sample configuration to log all outbound HTTPS connections:
<EventFiltering> <RuleGroup name="NetworkConnect" groupRelation="or"> <NetworkConnect onmatch="include"> <DestinationPort condition="is">443</DestinationPort> <DestinationPort condition="is">80</DestinationPort> </NetworkConnect> </RuleGroup> </EventFiltering>
-
For Linux environments monitoring Windows hosts – Deploy Zeek (formerly Bro) to inspect HTTP/S metadata and flag unusual user‑agent strings (e.g., “NetMonitorAgent”).
3. Hardening Endpoints Against RMM Abuse
Preventing unauthorized installation of RMM tools is more effective than detection alone. Use application control and privilege restrictions.
Step‑by‑step hardening guide (Windows):
- Deploy AppLocker rules to block executables from %TEMP% and user directories:
Create default rules (run as admin) New-AppLockerPolicy -RuleType Exe -User Everyone -Action Deny -Path "%USERPROFILE%\" Set-AppLockerPolicy -Policy $policy -Merge
-
Use Windows Defender Firewall to block outbound connections for unknown binaries – Create a rule that blocks all outbound traffic by default, then allow only specific signed apps:
netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound netsh advfirewall firewall add rule name="Allow HTTP/HTTPS for browsers" dir=out protocol=TCP remoteport=80,443 action=allow program="C:\Program Files\Internet Explorer\iexplore.exe"
-
Restrict installation via Group Policy – Disable Windows Installer and MSI execution for non‑admins:
gpedit.msc -> Computer Config -> Administrative Templates -> Windows Components -> Windows Installer -> "Disable Windows Installer" -> Enabled (Always)
4. Linux Counterparts: Detecting Cross‑Platform RMM Tools
Many RMM agents now have Linux versions (e.g., Net Monitor for Employees does not natively support Linux, but similar tools like AnyDesk, TeamViewer, or MeshAgent do). Use these commands to spot unusual remote access processes.
Step‑by‑step guide for Linux detection:
1. List listening and established network connections:
sudo netstat -tunap | grep -E "ESTABLISHED|LISTEN" | grep -v "127.0.0.1"
- Find processes with high CPU/memory that don’t match known services:
ps aux --sort=-%cpu | head -20 lsof -i -P -n | grep LISTEN
-
Check systemd services for unusual remote management units:
systemctl list-units --type=service | grep -i "remote|agent|monitor" journalctl -u [suspicious-service] -n 50
-
Use auditd to monitor execution of binaries from non‑standard paths:
auditctl -w /usr/local/bin -p x -k custom_bin_exec ausearch -k custom_bin_exec
-
Incident Response: What to Do When You Find an Unauthorized RMM Agent
If Net Monitor for Employees (or any LOLRMM tool) is discovered on a production machine, follow these containment and eradication steps.
Step‑by‑step IR guide:
-
Isolate the host immediately – Disable network adapter or block MAC address at switch level:
PowerShell: Disable network adapter Disable-NetAdapter -Name "Ethernet" -Confirm:$false
-
Collect forensic artifacts – Memory dump and prefetch files:
Create a memory dump using built-in tools (WinDbg or DumpIt) tasklist /svc /fi "IMAGENAME eq NetMonitor.exe" Capture prefetch for timeline analysis copy C:\Windows\Prefetch\NETMONITOR.pf C:\forensics\
3. Terminate and remove the tool:
taskkill /F /IM NetMonitor.exe sc stop "NetMonitorService" sc delete "NetMonitorService"
- Check for lateral movement – Query Windows Event Logs for remote logins (Event ID 4624 with Logon Type 3 or 10):
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624} | Where-Object {$_.Properties[bash].Value -in 3,10} | Format-List
What Undercode Say:
- Key Takeaway 1: Legitimate RMM tools are the new living‑off‑the‑land binaries—detection must shift from signature‑based to behavior‑centric analysis, focusing on unexpected process parents, network beaconing, and registry persistence.
- Key Takeaway 2: Visibility is your first line of defense; enabling Sysmon, PowerShell logging, and firewall outbound rules transforms a blind spot into a sensor grid. Attackers will continue abusing Net Monitor for Employees because most organizations still treat it as “just IT software.”
The inclusion of Net Monitor for Employees in LOLRMM is a wake‑up call: enterprise security teams must inventory all RMM agents, enforce installation via change management, and monitor for unsanctioned instances. Traditional antivirus won’t flag these tools—but a combination of network anomaly detection, application whitelisting, and user‑behavior analytics will. Moreover, red teams will increasingly embed RMM tools as persistence mechanisms because they offer GUI remote control, file transfer, and often bypass EDRs that trust signed Microsoft or legitimate vendor binaries. Don’t wait for an incident; start testing your detection rules against the LOLRMM project today.
Prediction:
As LOLRMM entries grow, we will see AI‑driven detection models that baseline “normal RMM behavior” (e.g., typical update frequencies, parent processes like msiexec or SCCM) and flag outliers. Simultaneously, attackers will begin using polymorphic RMM wrappers that slightly alter network fingerprints and registry keys to evade static IOC hunting. The future of RMM abuse will pivot toward cloud‑native agents (e.g., AWS Systems Manager, Azure ARC) that blend into modern DevOps pipelines, making detection exponentially harder without deep integration with cloud security posture management (CSPM) tools. Organizations that fail to adopt zero‑trust principles for administrative tooling will remain vulnerable.
▶️ Related Video (70% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: New Lolrmm – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
