How Attackers Abuse Remote Management Tools for Access and Persistence
Summary
A Huntress webinar recap explains how attackers misuse RMM tools for remote access and persistence, discusses challenges in detecting abuse, and demonstrates silently installing AnyDesk from a Sliver beacon.
Key points
- The article describes remote monitoring and management tools as similar to command-and-control platforms that attackers can misuse.
- Huntress reported that about 65% of incidents in Q3 2023 involved RMM software used for persistence or remote access.
- A webinar segment discussed why RMM abuse can be difficult to detect and deter, and introduced hunting methods and relevant network and host indicators.
- The recap references a multi-stage attack against healthcare and pharmaceutical organizations that used ScreenConnect for remote access and persistence.
- A demonstration showed AnyDesk being silently installed from a Sliver C2 beacon to maintain persistence and start at boot.
Article Details
- Topic
- Abuse of remote monitoring and management software and remote access tools for command and control, persistence, and remote access.