Listen to this Post
Introduction:
Remote Monitoring and Management (RMM) tools are the lifeblood of IT administration, but their legitimate power has become a favorite cloak for adversaries seeking persistent, trusted access. The recent addition of a community-developed Sysmon configuration to the LOLRMM project bridges the gap between knowing which tools are abused and actually detecting their malicious use in your environment, transforming intelligence into actionable, high-fidelity telemetry.
Learning Objectives:
- Understand how to deploy and leverage a specialized Sysmon configuration to monitor RMM tool activity.
- Gain visibility into process execution patterns associated with legitimate and suspicious remote access.
- Integrate LOLRMM intelligence with endpoint detection to build a proactive defense against living-off-the-land binaries.
You Should Know:
- Understanding the New Sysmon Configuration for RMM Monitoring
The LOLRMM project catalogs legitimate remote management tools that are frequently abused by attackers for command execution, lateral movement, and persistence. The new Sysmon configuration, contributed by DodgeThisSecurity, provides a tailored starting point for defenders. Instead of generic Sysmon rules, this configuration specifically focuses on process creation, network connections, and file events tied to the binaries listed in the LOLRMM framework. It aims to reduce noise by filtering for events that matter—executions of RMM tools, unusual parent-child process relationships, and connections to unexpected external IPs.
Step‑by‑step guide:
- Download the Configuration: Visit the pull request URL (https://github.com/magicsword-io/LOLRMM/pull/160) and obtain the `sysmon_config.xml` file. Review the rules to understand what is being monitored.
- Install Sysmon (if not present): On a Windows endpoint or server, download Sysmon from Microsoft Sysinternals. Run the installation with the new configuration:
Download Sysmon (example path) Invoke-WebRequest -Uri "https://live.sysinternals.com/Sysmon64.exe" -OutFile "C:\Tools\Sysmon64.exe" Install with the new config C:\Tools\Sysmon64.exe -accepteula -i C:\Path\to\sysmon_config.xml
- Verify Installation: Check that Sysmon is running and events are being logged to the Windows Event Log (Applications and Services Logs/Microsoft/Windows/Sysmon/Operational).
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 10
- Tune the Configuration: Monitor the logs for a few days. Use the Event Viewer to filter for Event IDs 1 (Process Creation) and 3 (Network Connection) related to known RMM binaries like
AnyDesk.exe,TeamViewer.exe, orScreenConnect.exe. Adjust the config by adding or removing hashes or command-line patterns based on your environment’s legitimate usage.
2. Integrating LOLRMM Intelligence with Sysmon Telemetry
The core value of this addition is the contextual link between the LOLRMM database and live endpoint telemetry. By combining the configuration with a SIEM or log aggregation tool, defenders can create alerts that trigger only when an RMM tool executes in a context that deviates from the norm.
Step‑by‑step guide:
- Forward Sysmon Logs: Configure Windows Event Forwarding or use an agent like Winlogbeat to send Sysmon logs to a central SIEM (e.g., Splunk, Elastic, Sentinel).
Example Winlogbeat configuration snippet for sysmon winlogbeat.event_logs:</li> </ol> - name: Microsoft-Windows-Sysmon/Operational
2. Create Detection Rules: In your SIEM, create a rule that looks for process creation events (Event ID 1) where the `Image` or `OriginalFileName` field matches a known RMM executable from the LOLRMM list. Correlate with network connections (Event ID 3) to new or rare destination IPs.
– Elastic Query Example:{ "query": { "bool": { "must": [ { "match": { "winlog.event_id": 1 } }, { "wildcard": { "winlog.event_data.Image": "\AnyDesk.exe" } } ] } } }3. Baseline and Alert: After establishing a baseline of legitimate RMM usage (e.g., from known IT support IPs or scheduled maintenance windows), set alerts for any execution outside these parameters. This configuration provides the raw data; the SIEM rule turns it into actionable intelligence.
3. Hardening Linux Endpoints for RMM Detection
While Sysmon is Windows-centric, RMM tools are also prevalent on Linux systems. To achieve comprehensive coverage, Linux endpoints should be monitored using tools like `osquery` or `auditd` to detect similar patterns.
Step‑by‑step guide:
- Install and Configure auditd: On a Linux system, ensure `auditd` is installed. Create rules to monitor execution of common Linux RMM agents (e.g.,
screen,ssh,anydesk,teamviewer).sudo apt install auditd audispd-plugins Debian/Ubuntu sudo yum install audit RHEL/CentOS
- Add Audit Rules: Append rules to `/etc/audit/rules.d/audit.rules` to watch for execution of RMM binaries.
-w /usr/bin/anydesk -p x -k rmm_execution -w /usr/bin/teamviewer -p x -k rmm_execution -w /usr/bin/screen -p x -k rmm_execution
- Restart auditd and Monitor: Restart the service and use `ausearch` or forward logs to your SIEM.
sudo systemctl restart auditd sudo ausearch -k rmm_execution
4. Testing the Configuration and Simulating an Attack
To validate that the new Sysmon config catches malicious RMM activity, defenders can simulate a benign but suspicious scenario using a known LOLRMM binary.
Step‑by‑step guide:
- Download a Test RMM Tool: Obtain a legitimate RMM tool like `AnyDesk` from a trusted source in a controlled lab environment.
- Execute with Suspicious Parameters: Run the executable from a non-standard location (e.g.,
C:\Users\Public\anydesk.exe) with command-line arguments that might indicate stealth, such as `–start-minimized` or--silent.C:\Users\Public\anydesk.exe --start-minimized --install
- Check Sysmon Events: Immediately after execution, query the Sysmon event log for the process creation event.
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=1} | Where-Object { $_.Message -like 'anydesk' } - Analyze the Output: The event should show the parent process (likely `explorer.exe` or a command shell), the full command line, and the process hash. This confirms the configuration is capturing the necessary telemetry.
5. Enhancing Detection with Custom Sysmon Rules
The provided configuration is a starting point. To truly harden your environment, you should extend it with rules that capture specific LOLRMM tool behaviors, such as service installation, registry persistence, or outbound connections to TOR or unusual ports.
Step‑by‑step guide:
- Add Network Connection Rules: Modify the `sysmon_config.xml` to include Event ID 3 rules that alert on RMM tools connecting to any IP except a predefined allowlist of internal management IPs.
<RuleGroup name="" groupRelation="or"> <NetworkConnect onmatch="exclude"> <Image condition="contains">AnyDesk.exe</Image> <DestinationIp condition="is not">192.168.1.0/24</DestinationIp> </NetworkConnect> </RuleGroup>
- Monitor for File Creation in Suspicious Locations: Add rules to alert when an RMM executable is dropped into a user-writable directory like `AppData` or
Temp.<FileCreateTime onmatch="include"> <Image condition="contains">anydesk.exe</Image> <TargetFilename condition="contains">\AppData\</TargetFilename> </FileCreateTime>
- Reload Configuration: After editing, update Sysmon without a full reinstall:
C:\Tools\Sysmon64.exe -c C:\Path\to\updated_sysmon_config.xml
What Undercode Say:
- Key Takeaway 1: The integration of community-driven Sysmon configurations with the LOLRMM project represents a shift from passive intelligence to active detection, enabling defenders to quickly operationalize threat research.
- Key Takeaway 2: Effective monitoring requires a multi-platform approach; while Sysmon provides deep visibility on Windows, Linux endpoints must be covered with `auditd` or `osquery` to prevent gaps in RMM tool abuse detection.
The addition of a purpose-built Sysmon config to LOLRMM is more than just a new rule set—it’s a blueprint for how defensive tooling should evolve. By focusing on the intersection of attacker tradecraft (abusing RMM tools) and native logging capabilities, this initiative lowers the barrier to entry for SOC teams. It transforms a static list of binaries into a dynamic detection engine. The step-by-step deployment and testing guides provided here ensure that this intelligence doesn’t remain theoretical but becomes a core component of your endpoint detection strategy. As adversaries increasingly leverage IT administration tools to blend in, the ability to distinguish between benign admin activity and malicious exploitation will hinge on well-tuned, context-aware logging like this.
Prediction:
As LOLRMM and similar projects mature, we will likely see an ecosystem of specialized logging configurations emerge, tailored to specific attack vectors like remote access, tunneling, and credential harvesting. This trend will push endpoint detection and response (EDR) vendors to incorporate community-sourced detection logic more openly, blurring the lines between open-source intelligence and commercial security products. Defenders who adopt these proactive, customizable configurations today will gain a significant advantage in visibility over adversaries who rely on the misuse of trusted administrative tools.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: New Sysmon – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeTesting & Stay Tuned:
- Install and Configure auditd: On a Linux system, ensure `auditd` is installed. Create rules to monitor execution of common Linux RMM agents (e.g.,
