Listen to this Post
Introduction:
Remote Monitoring and Management (RMM) tools like ScreenConnect (now ConnectWise Control) are essential for IT teams but have become a favored weapon for attackers. By exploiting these legitimate applications – often delivered via phishing emails – adversaries gain silent, persistent access without triggering traditional malware alerts. A single click can install a background service that gives full remote control, turning a trusted tool into a covert backdoor.
Learning Objectives:
- Understand how attackers abuse legitimate RMM software for initial access and persistence.
- Learn to detect anomalous RMM installations using Sysmon, PowerShell, and EDR logs.
- Implement proactive blocking strategies including AppLocker, Windows Defender Application Control, and behavioral rules to stop unauthorized installs at the gate.
You Should Know
- How the ScreenConnect (ConnectWise Control) Attack Chain Works
Attackers start with a phishing email containing a link to a legitimate ScreenConnect installer. Once clicked, the installer is downloaded and executed with silent arguments, registering a new service on the victim’s machine without any visible interface. The attacker then connects through the RMM’s cloud relay, bypassing firewalls and remaining unnoticed.
Step‑by‑step guide – simulating the malicious install (for defensive testing):
- Download the genuine ScreenConnect installer from the official source.
- Run it silently using command‑line arguments to avoid UI prompts:
Windows (Command Prompt or PowerShell):
ScreenConnect_Setup.exe /quiet /norestart /install /SERVICEACCOUNT="LocalSystem" /SERVICENAME="ScreenConnect Client (xxxxx)"
PowerShell alternative:
Start-Process -FilePath "ScreenConnect_Setup.exe" -ArgumentList "/quiet /norestart /install" -Wait
3. Verify the service is running:
Get-Service -Name "ScreenConnect"
- The attacker’s console (ConnectWise Control) now shows the device online. No malware, no alerts – just a trusted tool.
Detection tip: Monitor for silent installations (/quiet or /qn) of RMM software, especially from non‑standard locations or initiated by unprivileged users.
2. Detecting RMM Abuse with Sysmon and PowerShell
Sysmon logs process creation, network connections, and file changes – critical for catching stealthy RMM installs.
Step‑by‑step configuration:
1. Install Sysmon on Windows:
Sysmon64.exe -accepteula -i sysmonconfig.xml
- Use a configuration that logs all process creation with command‑line arguments:
<EventFiltering> <ProcessCreate onmatch="include"> <CommandLine condition="contains">ScreenConnect</CommandLine> </ProcessCreate> </EventFiltering>
-
After the attack simulation (or live monitoring), query Sysmon events (Event ID 1) for ScreenConnect:
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=1} | Where-Object {$_.Message -like "ScreenConnect"} -
To detect outbound connections to known RMM cloud relays, use Sysmon Event ID 3 (network connect). Example PowerShell filter:
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=3} | Where-Object {$_.Message -match "screenconnect.com|connectwise.com"}
Pro tip: Forward these events to a SIEM for automated correlation – sudden RMM installs on endpoints that never use IT support are high‑risk indicators.
- Blocking Unauthorized RMM Installs via AppLocker or Windows Defender Application Control (WDAC)
Prevention beats detection. Use built‑in Windows controls to whitelist only approved RMM versions.
Step‑by‑step with AppLocker (Windows 10/11 Pro/Enterprise):
- Open `secpol.msc` → Application Control Policies → AppLocker.
2. Right‑click Executable Rules → Create New Rule.
3. Choose Deny action, then Publisher condition.
- Click Select to browse a legitimate ScreenConnect executable.
– Set Publisher to block all versions except your approved ones.
5. Apply rule and start the AppLocker service:
Start-Service AppIDSvc Set-Service AppIDSvc -StartupType Automatic
- To block all RMM installers globally via PowerShell (using a hash rule):
$hash = (Get-FileHash "C:\path\to\ScreenConnect_Setup.exe").Hash New-AppLockerPolicy -RuleType Hash -User Everyone -Action Deny -Hash $hash
For WDAC (more advanced):
Create a base policy allowing only signed Microsoft components and your approved RMM binaries. Use `ConfigCI` PowerShell cmdlets to generate and deploy.
- Linux Equivalent: Monitoring for RMM Tools (AnyDesk, TeamViewer, etc.)
Linux environments face similar threats – attackers deploy RMM clients to maintain access.
Step‑by‑step with auditd:
- Install auditd: `sudo apt install auditd` (Debian/Ubuntu) or `sudo yum install audit` (RHEL).
- Add rules to monitor execution of common RMM binaries:
sudo auditctl -w /usr/bin/anydesk -p x -k rmm_exec sudo auditctl -w /usr/bin/teamviewer -p x -k rmm_exec sudo auditctl -w /opt/screenconnect -p x -k rmm_exec
3. Search audit logs for RMM execution:
sudo ausearch -k rmm_exec
Using eBPF (with bpftrace):
Detect any `execve` call for RMM processes:
sudo bpftrace -e 'tracepoint:syscalls:sys_enter_execve { printf("%s executed %s\n", comm, str(args->filename)); }'
Prevention on Linux:
Use AppArmor or SELinux policies to block unauthorized execution of RMM binaries. Example AppArmor profile to deny:
/usr/bin/anydesk {
deny /usr/bin/anydesk ix,
}
5. MagicSword’s Approach – Pre‑Execution Prevention (Behavioral Analysis)
Instead of relying solely on signatures, MagicSword intercepts the installer at runtime, inspecting command‑line arguments, parent process, and user context.
Generic EDR rule equivalent (pseudo‑code for detection/blocking):
if (process == "ScreenConnect_Setup.exe" OR process == "ConnectWiseControl.exe") {
if (command_line contains "/quiet" OR "/qn" OR "/silent") {
if (parent_process NOT in ["msiexec.exe", "services.exe"] OR user_is_non_admin) {
BLOCK_AND_ALERT("Suspicious silent RMM install")
}
}
}
Step‑by‑step to implement similar logic with custom PowerShell monitoring (real‑time):
– Use a `WMI` subscription to Win32_ProcessStartTrace.
– When a new process is created, check its command line and parent ID.
– If a match occurs, terminate the process:
$query = "SELECT FROM Win32_ProcessStartTrace WHERE ProcessName='ScreenConnect_Setup.exe'"
Register-WmiEvent -Query $query -Action {
$proc = Get-Process -Id $Event.SourceEventArgs.NewEvent.ProcessID
if ($proc.CommandLine -match "/quiet") {
Stop-Process -Id $proc.Id -Force
Write-EventLog -LogName Application -Source "RMMProtection" -EntryType Warning -EventId 100 -Message "Blocked silent RMM install"
}
}
Note: This is a lightweight demonstration; production solutions use kernel‑level callbacks or EDR agents.
- Incident Response: What to Do When RMM Abuse Is Detected
If you discover an unauthorized RMM client already installed, act swiftly.
Step‑by‑step IR for Windows:
- Isolate the endpoint: Disable network adapters or cut switch port.
2. Kill the RMM process:
Get-Process -Name "ScreenConnect" | Stop-Process -Force
3. Stop and delete the service:
net stop "ScreenConnect Client (xxxxx)" sc delete "ScreenConnect Client (xxxxx)"
4. Remove persistence from registry:
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v ScreenConnect /f reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v ScreenConnect /f
5. Block the attacker’s IPs at firewall level (check logs for outbound connections to the RMM relay).
6. Perform a full EDR scan and revoke any session tokens that may have been stolen.
For cloud‑connected environments (Azure/AWS):
Revoke active user sessions and rotate secrets if the compromised device had access:
az account clear az ad user signin-revoke --user-id <victim_upn>
aws sts revoke-sessions --username <victim_username>
7. Hardening Against Living‑off‑the‑Land RMM Tactics
Attackers increasingly use only legitimate tools – no malware to signature. Hardening requires a zero‑trust approach to “trusted” software.
Key mitigations:
- Application control: Only allow RMM installs from a dedicated, privileged account with Just‑in‑Time (JIT) elevation.
- Network segmentation: Endpoints that do not require remote support should not be able to reach RMM cloud domains. Use DNS filtering:
Linux /etc/hosts blackhole 127.0.0.1 screenconnect.com 127.0.0.1 connectwise.com
- User education: Train employees to recognize fake “IT support” installers – even if the digital signature is valid.
- Monitor installer execution patterns: Look for `/quiet` from a user’s Downloads folder.
Automated detection using Sigma rules:
title: Silent RMM Installation status: experimental logsource: product: windows, service: sysmon detection: selection: EventID: 1 CommandLine|contains: - '/quiet' - '/qn' Image|endswith: - 'ScreenConnect_Setup.exe' - 'AnyDesk.exe' - 'TeamViewer_Setup.exe' condition: selection
What Undercode Say
- Key Takeaway 1: Legitimate RMM tools are now primary vectors for stealthy access – a 277% surge in abuse proves this is not an edge case.
- Key Takeaway 2: Prevention is possible without blocking all IT productivity. Using application control, behavioral rules, and real‑time process monitoring stops the install before the attacker’s console ever sees the endpoint.
The MagicSword incident highlights a fundamental shift: attackers no longer need malware. They exploit the very software we trust. Defenders must respond by treating every executable – even signed, legitimate ones – as a potential threat until proven otherwise. This means moving from reactive detection to proactive, pre‑execution blocking. The commands and configurations provided (Sysmon, AppLocker, auditd, eBPF) offer a free, actionable blueprint to replicate this protection. Organizations that rely solely on antivirus are already behind.
Prediction:
By 2027, RMM abuse will become a top‑five initial access vector in incident response reports. Attackers will increasingly embed custom RMM payloads in phishing lures and supply‑chain attacks. The industry will respond with “trusted tool zero‑trust” frameworks – requiring dynamic, context‑aware policies that block any remote access software unless explicitly authorized per session. Expect Microsoft to enhance Defender for Endpoint with dedicated RMM behavioral detections, and open‑source tools like osquery to include pre‑built queries for unauthorized RMM installations. The cat‑and‑mouse game is shifting from malware to legitimate software – and the defenders who adapt will dictate the next decade of cybersecurity.
▶️ Related Video (74% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: How Magicsword – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
