Full Report
Read about our journey to unravel a PowerShell reverse shell—and how our Managed EDR feature tipped us off that something wasn’t right.
Analysis Summary
# Incident Report: PowerShell Reverse Shell via Compromised RMM
## Executive Summary
This incident involved a sophisticated attempt to establish a reverse shell on a target system using an obfuscated PowerShell payload. The attack was initiated through a compromised ScreenConnect (RMM) instance, posing a significant risk of cascading compromise across the managed network. Huntress Managed EDR detected the encoded command, allowing for rapid decoding and intervention before further lateral movement or data impact could occur.
## Incident Details
- **Discovery Date:** September 13, 2022 (Publication Date)
- **Incident Date:** Circa September 2022
- **Affected Organization:** Confidential Huntress Partner
- **Sector:** Managed Service Provider (MSP) / Client of MSP
- **Geography:** Undisclosed
## Timeline of Events
### Initial Access
- **Date/Time:** Undisclosed
- **Vector:** Exploitation of Remote Monitoring and Management (RMM) software.
- **Details:** The attacker gained unauthorized access to the partner’s **ScreenConnect** instance, providing a high-privilege foothold to execute commands on managed endpoints.
### Lateral Movement
- **Details:** The attacker attempted to use the RMM access to execute PowerShell commands across the environment. By leveraging a trusted management tool, the attacker aimed to bypass traditional perimeter security.
### Data Exfiltration/Impact
- **Details:** No data exfiltration was reported. The primary impact was the establishment of a persistent command-and-control (C2) channel via a reverse shell, which could have led to ransomware deployment or full network compromise.
### Detection & Response
- **Discovery:** Huntress Managed EDR alerted on a highly suspicious, Base64-encoded PowerShell process spawned by the ScreenConnect parent process.
- **Response:** Analysts decoded the payload using CyberChef, identified the malicious C2 domain (`hxxps[://]onerecoveryclick`), and neutralized the threat.
## Attack Methodology
- **Initial Access:** Compromised RMM (ScreenConnect).
- **Persistence:** Attempted establishment of a reverse shell.
- **Privilege Escalation:** Inherited SYSTEM/Administrator privileges from the RMM agent.
- **Defense Evasion:** Used Base64 encoding for PowerShell commands and a staging domain that appeared benign (empty/loading) to standard web scanners.
- **Discovery:** RMM tools naturally provide discovery of all connected assets.
- **Lateral Movement:** Execution of scripts via the RMM console to multiple endpoints.
- **Impact:** Potential for total environment takeover.
## Impact Assessment
- **Financial:** Prevented potential ransomware costs.
- **Data Breach:** None confirmed; prevented.
- **Operational:** High risk; a compromised RMM could lead to a total shutdown of all managed clients.
- **Reputational:** High risk to the MSP due to the "cascading damage" potential of RMM breaches.
## Indicators of Compromise
- **Network Indicators:** `hxxps[://]onerecoveryclick`
- **Behavioral Indicators:**
- `powershell.exe` spawned by `ScreenConnect.ClientService.exe`.
- Execution of `powershell -enc` (EncodedCommand).
- Use of `Invoke-WebRequest` (IWR) to unknown external domains.
## Response Actions
- **Containment:** The malicious PowerShell process was terminated.
- **Eradication:** Investigation into the compromised ScreenConnect credentials/instance to revoke unauthorized access.
- **Recovery:** Verification of endpoint integrity and monitoring for re-emergence of C2 traffic.
## Lessons Learned
- **RMM Vulnerability:** RMM tools are "God-mode" for attackers; if the management server is compromised, the entire client base is at risk.
- **Obfuscation Detection:** Standard security tools often miss encoded PowerShell; behavior-based detection (EDR) is critical.
- **Manual Verification:** Attackers use "benign-looking" domains that only serve malicious content when specific headers (like User-Agents) are used, bypassing simple URL scanners.
## Recommendations
- **Enforce MFA:** Ensure Mandatory Multi-Factor Authentication for all RMM (ScreenConnect) logins.
- **Principle of Least Privilege:** Restrict the service accounts used by RMM agents where possible.
- **Monitor Parent-Child Relationships:** Set alerts for administrative tools (RMM, TeamViewer, etc.) spawning PowerShell or CMD with encoded flags.
- **Egress Filtering:** Limit the ability of servers to reach out to the open internet, specifically to new or uncategorized domains.