Listen to this Post
Introduction:
Remote Monitoring and Management (RMM) tools are the backbone of modern IT operations, offering unparalleled efficiency for system administrators and Managed Service Providers (MSPs). However, this same power has made them a prime target for cybercriminals, who are increasingly abusing legitimate remote management software like ConnectWise ScreenConnect, LogMeIn Resolve, and PDQ Connect to establish stealthy, persistent backdoors. This abuse allows attackers to blend in with legitimate traffic, bypass traditional security controls, and move laterally across networks, turning your essential IT tools into a hidden gateway for ransomware, data theft, and supply chain compromise.
Learning Objectives:
- Understand the techniques used by threat actors to abuse legitimate RMM software for malicious purposes.
- Develop practical skills to hunt for and identify rogue RMM processes and unauthorized installations across Windows and Linux environments.
- Implement proactive hardening measures, detection rules, and blocking strategies to prevent RMM abuse within your organization.
You Should Know:
- The Anatomy of RMM Abuse: How Attackers Weaponize Trusted Tools
The insidious nature of RMM abuse lies in its stealth. Attackers leverage legitimate tools to bypass trust assumptions, as the detection of an RMM client like ScreenConnect does not immediately arouse suspicion for most security teams. This tactic, often called “Living Off the Land” (LotL), is becoming increasingly popular among various threat groups, including ransomware operators.
Attackers typically gain initial access through several vectors:
- Phishing and Social Engineering: Deceiving users into downloading and executing malicious installers disguised as legitimate software, such as fake software updates or social security statement documents.
- Exploiting Vulnerabilities: Targeting unpatched RMM servers, such as the critical vulnerability CVE-2025-14265 in ScreenConnect, which allows an authenticated attacker to install untrusted extensions and execute arbitrary code on the server.
- Compromising MSPs: Gaining control of an MSP’s RMM instance to cast a wide net across their entire customer base, as seen in the infamous Kaseya VSA supply chain attack.
Once inside, attackers can use the RMM tool’s own features—like remote shell access, file transfer, and script execution—to move laterally, maintain persistence, and deploy secondary payloads like PatoRAT.
2. Hunting for Rogue RMMs: Hands-On Detection Guide
Proactively hunting for unauthorized RMM tools is your first line of defense. Here are practical commands to uncover suspicious activity.
For Windows (PowerShell as Administrator):
Hunt for common RMM processes by name
Get-CimInstance Win32_Process | Where-Object {$<em>.Name -like "splashtop" -or $</em>.Name -like "screenconnect" -or $<em>.Name -like "teamviewer" -or $</em>.Name -like "anydesk"} | Select-Object Name, ProcessId, CommandLine
This command identifies running processes for popular RMM tools by inspecting the `CommandLine` property, which can reveal suspicious arguments or execution from a temporary directory.
Hunt for silent installations in PowerShell logs
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" | Where-Object { $<em>.Message -like " -silent " -or $</em>.Message -like " -install " } | Select-Object -First 20 TimeCreated, Id, LevelDisplayName, Message
Attackers frequently use silent install switches (e.g., -silent, -verysilent) to deploy RMM agents without user interaction. This command searches PowerShell logs for these tell-tale parameters.
For Linux (Terminal):
List all processes and filter for common RMM software ps aux | grep -iE "(splashtop|screenconnect|teamviewer|anydesk|tacticalrmm)"
Execute this to find any matching processes. Pay close attention to the user running the process and the binary’s path; a process running from a `/tmp` directory or under a non-standard user is a significant red flag.
3. Blocking the Chain: Proactive Mitigation Strategies
The most effective approach is to prevent RMM abuse before it starts. MagicSword’s philosophy is simple: “If you don’t need it, it shouldn’t execute. Block the binaries → kill the chain → end the intrusion”.
Network-Level Blocking: Use your firewall to block outbound connections to known RMM domains and IP addresses.
– Linux (iptables): `sudo iptables -A OUTPUT -p tcp –dport 5938 -j DROP` (This blocks a common RMM port, 5938, used by TeamViewer).
– Windows (PowerShell): New-NetFirewallRule -DisplayName "Block RMM Tool" -Direction Outbound -Program "C:\Path\To\RMMTool.exe" -Action Block.
Endpoint Hardening: Leverage Windows Defender Application Control (WDAC) to create a policy that only allows approved software to run. This natively prevents any unauthorized RMM executable from loading on your endpoints.
4. Leveraging LOLRMM for Continuous Detection
The LOLRMM (Living Off the Land Remote Monitoring and Management) project is a community-driven, curated list of RMM tools that can be abused by threat actors. It provides a comprehensive catalog of indicators, including known domains, installation paths, and Sigma detection rules, to help security teams identify unauthorized RMM tools in their environment.
Integrating LOLRMM Data:
You can programmatically fetch the list of known RMM tools in JSON or CSV format for integration into your SIEM or custom scripts.
Fetch the complete list of RMM tools in JSON format curl https://lolrmm.io/api/rmm_tools.json
For Microsoft Defender for Endpoint (MDE) users, LOLRMM provides a KQL query to detect connections to any RMM domains not on your approved list.
// Detecting Unauthorized RMM Instances in Your MDE Environment let ApprovedRMM = dynamic(["your-company-domain.com", "another-approved-domain.com"]); let RMMList = externaldata(URI: string) [h'https://raw.githubusercontent.com/magicsword-io/LOLRMM/main/website/public/api/rmm_domains.csv']; DeviceNetworkEvents | where RemoteUrl has_any(RMMList) | where not (RemoteUrl has_any(ApprovedRMM))
This query immediately alerts on any network connection to a domain associated with an RMM tool that your organization has not explicitly approved.
5. Mitigating the MSP Supply Chain Risk
For MSPs, a compromised RMM instance represents a catastrophic supply chain risk. A single breach can provide an attacker with direct access to every downstream customer, leading to widespread ransomware deployment or data theft. To mitigate this, apply rigorous access controls:
– Enforce Multi-Factor Authentication (MFA): Mandate MFA for all administrative access to RMM platforms.
– Implement Least Privilege: Ensure that RMM agents operate with the minimum necessary privileges, preventing them from being used to add rogue users to the local administrators group.
– Segment Networks: Isolate RMM infrastructure from other critical systems and operational technology networks to limit lateral movement.
What Undercode Say:
- The abuse of RMM tools is one of the most significant and underrated threats facing organizations today. Attackers are simply weaponizing trust, and the default “allow” posture most security tools have for these applications is a critical blind spot.
- The solution is not to abandon RMMs but to radically change how we manage them. Moving from a passive monitoring model to an active, prevention-first approach—by creating allowlists, blocking all unapproved binaries, and continuously hunting for RMM-specific indicators—is the only way to stay ahead of this evolving threat.
Prediction:
As RMM abuse becomes the new normal for initial access, we will see a surge in zero-trust frameworks applied directly to IT management tools. The future will likely bring mandatory, real-time validation of RMM sessions and actions, moving beyond simple MFA to a model where every command is inspected and logged against a user’s baseline behavior. Furthermore, the “Living Off the Land” movement will force security vendors to hardcode detections for these once-trusted tools, shifting the cybersecurity landscape from a paradigm of implicit trust to one of continuous, adversarial verification.
▶️ Related Video (66% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Https: – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
