Full Report
In a highly interconnected world, remote monitoring and management (RMM) tools are critical to reducing cost and increasing efficiencies. However, these tools pose challenges and even significant risk if not properly managed.
Analysis Summary
# Best Practices: Secure RMM Management & Consolidation
## Overview
These practices address the significant security risks associated with Remote Monitoring and Management (RMM) tools. Because RMM tools possess high-level system permissions, they are frequently abused by threat actors for persistence, credential theft, and ransomware deployment. These guidelines focus on eliminating "Shadow RMM" (legacy or unauthorized tools) and hardening legitimate access.
## Key Recommendations
### Immediate Actions
1. **Audit for "Shadow RMM":** Scan all endpoints for unauthorized or legacy RMM agents (e.g., UltraVNC, ScreenConnect, AnyDesk, Atera, MeshCentral).
2. **Enforce MFA:** Ensure Multi-Factor Authentication is mandatory for all active RMM console logins.
3. **Block Known Abused Ports:** Close or restrict external access to ports commonly used by RMM/Remote Desktop tools (e.g., 3389 for RDP, 5900 for VNC) unless protected by a VPN or Zero Trust gateway.
4. **Identify Legacy Installs:** Specifically look for RMM tools left behind by previous IT service providers or MSPs.
### Short-term Improvements (1-3 months)
1. **Standardize Tooling:** Select a single, corporate-approved RMM and uninstall all others to reduce the attack surface.
2. **Implement EDR/MDR:** Deploy detection tools capable of identifying "Living off the Land" (LotL) techniques, such as threat actors using legitimate MSI installers (e.g., `msiexec.exe`) to deploy rogue RMMs.
3. **Log Centralization:** Ensure RMM logs (login/logoff events, file transfers) are ingested into a centralized SIEM or log management platform for auditability.
### Long-term Strategy (3+ months)
1. **Application Allowlisting:** Implement policy-based controls to prevent the execution of unauthorized `.msi` or `.exe` files associated with remote access tools.
2. **Zero Trust Architecture:** Transition away from open remote access toward identity-based, just-in-time (JIT) access models.
3. **Vendor Lifecycle Management:** Establish a formal process for offboarding MSPs that includes a verified "clean sweep" of their proprietary agents from all client endpoints.
## Implementation Guidance
### For Small Organizations
- Focus on visibility. Use free or built-in tools to inventory installed software.
- Prioritize uninstalling unused remote access tools like TeamViewer or AnyDesk that employees may have installed for personal convenience.
### For Medium Organizations
- Implement automated alerts for the installation of new RMM services.
- Conduct a "Legacy Cleanup" project to ensure that when switching service providers, the old provider's tools are completely removed via automated scripts.
### For Large Enterprises
- Use EDR exclusions/inclusions to flag any RMM activity not originating from the sanctioned corporate tool.
- Segment networks to ensure that even if an RMM tool is compromised, lateral movement (e.g., via SMB/RPC) is restricted.
## Configuration Examples
While specific tool configurations vary, the following technical patterns are recommended:
- **Command Line Monitoring:** Watch for `msiexec.exe /i` commands involving unknown `.msi` files in `\Users\...\Music\` or `\Windows\TEMP\`, as these are common staging areas for attackers.
- **VNC Hardening:** If VNC must be used, disable password-only authentication and require SSH tunneling or VPN access.
- **Binary Naming:** Alert on common RMM process names (e.g., `AteraAgent.exe`, `ScreenConnect.Service.exe`) if they appear on segments where they are not officially deployed.
## Compliance Alignment
- **NIST CSF:** PR.AC-4 (Access Control), DE.CM-1 (Monitoring for unauthorized software).
- **CIS Controls:** Control 2 (Inventory and Control of Software Assets), Control 12 (Network Infrastructure Management).
- **ISO 27001:** Annex A.12.6.1 (Management of technical vulnerabilities).
## Common Pitfalls to Avoid
- **The "Leftover" Agent:** Assuming a previous MSP removed their tools upon contract termination.
- **Trusting the Tool, Not the User:** Failing to monitor what a "legitimate" RMM is doing (e.g., running `mimikatz` or `XenArmor`).
- **Ignoring Failed Logins:** Overlooking brute-force attempts on RMM portals (as seen in the UltraVNC case study).
## Resources
- **Huntress Blog (Threat Insights):** [huntress[.]com/blog/insights-rmm-tools]
- **Arctic Wolf Threat Report:** [arcticwolf[.]com/resource/arctic-wolf-threat-report-2025]
- **CISA Guide on Securing RMM:** [cisa[.]gov/resources-tools/resources/securing-remote-monitoring-and-management-software]