How to Detect Threat Actors’ Abuse of Remote Management Tools

Article Details

Defense Focus

Detect and prevent abuse of legitimate Remote Monitoring and Management (RMM) tools by building an environment inventory, identifying first-seen and uncommon tools, and correlating RMM activity with suspicious events.

Detection Methods

• Enrich incoming events against LOLRMM indicators covering process, network, service, registry, file, and hash artifacts.
• Track observed RMM tools by user and host; alert when an RMM is first seen within a configured timeframe.
• Use prevalence analysis to identify RMM tools uncommon across the environment.
• Correlate first-seen RMM activity with Microsoft Teams impersonation or phishing detections, including matching victim and RMM-associated identities within 30 minutes.
• Detect multiple distinct RMM tools on one host, including sequential use such as Action1 followed by ScreenConnect.
• Use process context and network indicators together; consider non-browser processes connecting to RMM endpoints.
• Hunt for suspicious execution context, including renamed binaries, unusual paths or arguments, unexpected parent or child processes, suspicious file writes, and execution near host or network enumeration.
• Use network appliance signatures that categorize outbound RMM traffic and trace it to the originating endpoint.

Data Sources

• Endpoint process and device events
• Process paths, names, PE metadata, and OriginalFileName
• Code signer metadata
• File, installation, and disk artifacts
• Registry artifacts and service installation details
• Network domains, hostnames, remote ports, and outbound connection telemetry
• Microsoft Defender for Endpoint Device events
• Microsoft 365 Audit Logs, including Teams operation events
• Microsoft Teams message events and account identifiers such as object ID, UPN, and email
• Sysmon events
• RMM inventory and historical user/host observations

Rule Types

• LOLRMM indicator lookup and event enrichment
• First-seen-by-host and first-seen-by-user detections
• Prevalence and outlier analytics
• Cross-source, time-window correlation rules
• Multiple-RMM-per-host detections
• Network appliance application-category or remote-access signatures

Platforms

• Abstract
• Microsoft Defender XDR
• Microsoft 365
• Microsoft Teams
• Palo Alto NGFW
• SonicWall IPS
• FortiGuard application control

Defensive Actions

• Maintain an inventory of approved RMM tools and update it as tools change.
• Normalize LOLRMM data before using it for detection; account for generic indicators, wildcard and regex patterns, placeholders, registry-hive variations, path formats, and unreliable signer values.
• Mark approved business-use tools as sanctioned to suppress expected activity in downstream analytics.
• Correlate first-seen RMM use with phishing, impersonation, and other suspicious activity rather than alerting on every observed indicator.
• Investigate multiple RMM tools on a host and RMM activity near lateral movement, enumeration, or other suspicious events.
• Work toward blocking RMM tools outside an approved list where reliable identification and operational requirements permit.
• Retain observations for a configured period so infrequent RMM use remains visible.