Full Report
Tips and tricks to hunt down RMM abuse. Remote access tools for persistence. Are RMMs really just command and control? January’s Tradecraft Tuesday was wild. Here’s the recap.
Analysis Summary
# Tool/Technique: Remote Monitoring and Management (RMM) Abuse
## Overview
RMM abuse involves threat actors weaponizing legitimate IT management software to function as Command and Control (C2) frameworks. Because these tools are digitally signed, widely trusted by antivirus solutions, and provide native administrative access, they allow attackers to maintain persistent access and execute commands while blending in with legitimate administrative traffic.
## Technical Details
- **Type:** Technique (Living-off-the-Land / Living-off-the-Binary)
- **Platform:** Windows, macOS, Linux
- **Capabilities:** Remote desktop access, file transfer, command execution, persistence, and system monitoring.
- **First Seen:** Continuous (Significant spike noted in Q3 2023, where 65% of incidents involved RMM weaponization).
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- **[T1547 - Boot or Logon Autostart Execution]** (e.g., configuring RMM to start at boot)
- **[TA0011 - Command and Control]**
- **[T1219 - Remote Access Software]** (Primary technique for this tool class)
- **[TA0005 - Defense Evasion]**
- **[T1562.001 - Impair Defenses: Disable or Modify Tools]** (Using RMM to disable security software)
- **[T1027 - Obfuscated Files or Information]** (Blending in with legitimate admin traffic)
## Functionality
### Core Capabilities
- **Remote Desktop/Terminal:** Interactive control of the victim machine.
- **File Management:** Uploading malware (Sliver beacons, ransomware) and exfiltrating data.
- **Command Execution:** Running PowerShell or CMD scripts with SYSTEM or Administrator privileges.
- **Silent Installation:** Ability to be installed via command line (CLI) without user notification.
### Advanced Features
- **Persistence via "Bitter Pill":** Multi-stage attack chains leveraging RMM (like ScreenConnect) to ensure long-term access to high-value targets.
- **Boot Persistence:** Configuring services to ensure the RMM agent restarts automatically upon reboot.
## Indicators of Compromise
- **File Names:** `AnyDesk.exe`, `ScreenConnect.Client.exe`, `SimpleHelp.exe`, `ConnectWiseControl.Client.exe` (often renamed or hidden in temporary directories).
- **Network Indicators:**
- `*.anydesk[.]com`
- `*.screenconnect[.]com`
- Connections to known C2 frameworks like **Sliver** originating from RMM-managed processes.
- **Behavioral Indicators:**
- Silent installation flags (e.g., `--install` or `/S` for AnyDesk).
- Unrecognized RMM agents running on systems not managed by the central IT team.
- RMM software executing encoded PowerShell commands.
## Associated Threat Actors
- **Bitter Pill** (Targeting healthcare/pharmaceutical sectors)
- Ransomware groups (Abusing SimpleHelp and GoTo Resolve)
- Various unidentified actors leveraging **Sliver C2** in conjunction with RMM tools.
## Detection Methods
- **Signature-based detection:** Monitoring for known RMM binaries in unauthorized locations (e.g., `C:\Users\Public\`).
- **Behavioral detection:**
- Monitoring for RMM tools spawned by suspicious parent processes (like a web browser or Word).
- Tracking unusual outbound network connections from administrative tools.
- **Process Auditing:** Identifying "Shadow IT" or secondary RMM tools that do not match the organization’s standard software stack.
## Mitigation Strategies
- **Software Whitelisting:** Use AppLocker or Windows Defender Application Control (WDAC) to block all RMM tools except the one officially used by the organization.
- **Hardening:** Implement Multi-Factor Authentication (MFA) on all RMM management portals.
- **Egress Filtering:** Block network traffic to known RMM provider domains that are not in use by the company.
- **Least Privilege:** Ensure RMM agents do not run with higher privileges than necessary for their specific function.
## Related Tools/Techniques
- **Sliver C2:** An open-source cross-platform adversary emulation framework often used alongside RMMs.
- **AnyDesk / ScreenConnect / SimpleHelp / GoTo Resolve / PDQ:** Common legitimate tools frequently targeted for abuse.
- **Living off the Land (LoTL):** The broader strategy of using legitimate system tools for malicious purposes.