Full Report
In a highly interconnected world, remote monitoring and management (RMM) tools are critical to reducing cost and increasing efficiencies. However, these tools pose challenges and even significant risk if not properly managed.
Analysis Summary
# Best Practices: Remote Monitoring and Management (RMM) Security
## Overview
These practices address the significant risks associated with the proliferation and unauthorized use of Remote Monitoring and Management (RMM) tools. Because RMM tools provide elevated privileges and persistent access, they are prime targets for threat actors to maintain persistence, bypass security controls, and deploy ransomware. These guidelines aim to reduce the "RMM attack surface" and improve incident response capabilities.
## Key Recommendations
### Immediate Actions
1. **Inventory RMM Software:** Conduct an immediate scan of all endpoints to identify every installed RMM agent (e.g., Atera, AnyDesk, TeamViewer, Splashtop, ScreenConnect, UltraVNC).
2. **Decommission Legacy Tools:** Identify and uninstall RMM agents left over from previous MSP relationships or retired internal projects.
3. **Block Unauthorized Installers:** Implement blocklists for common RMM installers (`.msi` and `.exe` signatures) that are not part of the official corporate stack.
4. **Enforce MFA:** Ensure Multi-Factor Authentication is mandatory for all legitimate RMM administrative portals.
### Short-term Improvements (1-3 months)
1. **Log Centralization:** Configure RMM tools to send connection logs (Logon/Logoff/File Transfer) to a central SIEM or logging repository to ensure data is not lost if a threat actor runs "event deletion" scripts.
2. **Credential Hardening:** Change all RMM-related service account passwords and ensure VNC/remote desktop tools are not using weak or default passwords prone to brute-force attacks.
3. **Alerting on New Installations:** Set up automated alerts (via EDR or SIEM) for the execution of `msiexec.exe` involving known RMM software names (e.g., AteraAgent, MeshAgent).
### Long-term Strategy (3+ months)
1. **Standardization:** Mandate a "Single Pane of Glass" policy. Reduce the organization to one approved RMM tool and strictly prohibit "Shadow IT" remote access.
2. **Zero Trust Access:** Transition from traditional RMM/RDP access to a Zero Trust Network Access (ZTNA) model where access is granted per session based on identity and device health.
3. **Supply Chain Audits:** Perform quarterly reviews of MSP access levels, ensuring they follow the principle of least privilege.
## Implementation Guidance
### For Small Organizations
- **Focus on Visibility:** Use basic scripts to check `C:\Program Files` for unauthorized remote tools.
- **Simplicity:** If you use an MSP, ask them for a formal list of tools they use and request the removal of anything else found.
### For Medium Organizations
- **Policy Enforcement:** Establish a formal "Remote Access Policy" that explicitly lists approved tools.
- **EDR Monitoring:** Use Endpoint Detection and Response (EDR) to monitor for "Living off the Land" techniques where RMMs are used to download credential theft tools like Mimikatz.
### For Large Enterprises
- **Application Control:** Use AppLocker or Windows Defender Application Control (WDAC) to prevent any unauthorized RMM binaries from executing.
- **Geofencing:** Restrict RMM portal logins to specific geographic regions or known corporate IP ranges.
## Configuration Examples
- **Detection Logic:** Monitor for command lines similar to:
`msiexec.exe /i "C:\Users\<User>\Music\setup.msi"`
followed by the creation of folders in `C:\Windows\TEMP\unpack\`.
- **VNC Security:** Disable VNC over public-facing ports (e.g., 5900) and require a VPN for access.
## Compliance Alignment
- **NIST CSF:** PR.AC-4 (Access Control), DE.CM-7 (Monitoring for unauthorized code).
- **CIS Controls:** Control 2 (Inventory and Control of Software Assets), Control 12 (Network Infrastructure Management).
- **ISO 27001:** Annex A.9.4 (System and application access control).
## Common Pitfalls to Avoid
- **The "Ghost" MSP:** Failing to remove access for a former service provider, leaving a "backdoor" into the environment.
- **Over-Privilege:** Running RMM agents with full SYSTEM privileges when not required for daily tasks.
- **Ignoring "Failed Logins":** Dismissing failed login attempts on RMM tools (like UltraVNC) as routine noise; these are often precursors to a successful brute-force breach.
## Resources
- **Huntress Blog (RMM Insights):** hxxps[://]www[.]huntress[.]com/blog/insights-rmm-tools
- **Arctic Wolf 2025 Threat Report:** hxxps[://]arcticwolf[.]com/resource/arctic-wolf-threat-report-2025
- **CISA Guide on Securing RMM Software:** hxxps[://]www[.]cisa[.]gov/resources-tools/alerts-and-advisories/ms23-029