MSP360 RMM Abused to Deploy ScreenConnect: Detection and Response Guide for Dual-RMM Social Engineering Attacks

---
title: MSP360 RMM Agent Installation or Execution
description: Detects installation or execution of MSP360 (CloudBerry) RMM components. Any MSP360 presence should be validated against the organization's approved software inventory, as this tool is actively abused in social engineering campaigns to establish unauthorized remote access.
references:
  - https://thehackernews.com/2026/09/attackers-abuse-msp360-to-deploy.html
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/09/15
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|contains:
      - '\\MSP360'
      - '\\CloudBerry'
      - '\\Remote Management'
  selection_name:
    Image|endswith:
      - '\\MSP360.exe'
      - '\\OnlineBackup.exe'
      - '\\CloudBerryService.exe'
      - '\\RemoteManagementService.exe'
  selection_cmd:
    CommandLine|contains:
      - 'msp360'
      - 'cloudberrylab'
  condition: 1 of selection_*
falsepositives:
  - Organizations that legitimately deploy MSP360 for managed backup or remote administration - allowlist approved deployment paths and installer hashes
level: high
---
title: ScreenConnect Client Service Installation
description: Detects installation of the ConnectWise ScreenConnect client service, including renamed instances. ScreenConnect is frequently deployed as a second-stage RMM by threat actors after initial access via another tool such as MSP360.
references:
  - https://thehackernews.com/2026/09/attackers-abuse-msp360-to-deploy.html
  - https://attack.mitre.org/techniques/T1543/003/
author: Security Arsenal
date: 2026/09/15
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith: '\\sc.exe'
    CommandLine|contains:
      - 'ScreenConnect'
      - 'screenconnect'
  selection_ps:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
    CommandLine|contains:
      - 'ScreenConnect'
      - 'New-Service'
  selection_service_binary:
    CommandLine|contains:
      - 'ScreenConnect.ClientService.exe'
      - 'ScreenConnect.WindowsClient.exe'
  condition: 1 of selection_*
falsepositives:
  - Approved internal or MSP use of ScreenConnect - restrict to authorized deployment accounts and paths
level: high
---
title: Dual RMM Co-Occurrence - MSP360 Spawning ScreenConnect Deployment
description: Detects MSP360 agent processes spawning installers, script interpreters, or download commands consistent with second-stage RMM deployment. This parent-child relationship is a strong indicator of the dual-RMM intrusion pattern reported by Microsoft.
references:
  - https://thehackernews.com/2026/09/attackers-abuse-msp360-to-deploy.html
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/09/15
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\\MSP360'
      - '\\CloudBerry'
      - '\\Remote Management'
  selection_child:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\cmd.exe'
      - '\\msiexec.exe'
      - '\\curl.exe'
      - '\\certutil.exe'
      - '\\bitsadmin.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate MSP360 remote scripting by an authorized administrator - validate against change records and approved admin accounts
level: critical

let RMM_MSP360 = dynamic(["MSP360.exe", "CloudBerryService.exe", "OnlineBackup.exe", "RemoteManagementService.exe"]);
let SuspiciousChildren = dynamic(["powershell.exe", "pwsh.exe", "cmd.exe", "msiexec.exe", "curl.exe", "certutil.exe", "bitsadmin.exe", "wscript.exe", "cscript.exe", "rundll32.exe"]);
// Hunt 1: MSP360 execution or installation artifacts
let msp360_events = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName in~ (RMM_MSP360)
   or ProcessCommandLine has_any ("msp360", "cloudberrylab", "cloudberry")
   or FolderPath has_any ("\\MSP360\\", "\\CloudBerry\\", "\\Remote Management\\")
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;
// Hunt 2: ScreenConnect installation
let screenconnect_events = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName has_any ("ScreenConnect.ClientService.exe", "ScreenConnect.WindowsClient.exe")
   or ProcessCommandLine has "screenconnect"
   or FolderPath has "ScreenConnect"
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName;
// Hunt 3: Dual-RMM chain - MSP360 parent spawning deployment tooling
let dual_rmm_chain = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFolderPath has_any ("\\MSP360\\", "\\CloudBerry\\")
   or InitiatingProcessFileName in~ (RMM_MSP360)
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256;
// Combine and surface devices with co-occurring RMM artifacts
union msp360_events, screenconnect_events, dual_rmm_chain
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), DistinctProcesses = dcount(FileName) by DeviceName
| where DistinctProcesses > 1 or EventCount > 0
| sort by LastSeen desc

SecurityEvent
| where TimeGenerated > ago(30d)
| where EventID == 7045
| where ServiceName has_any ("MSP360", "CloudBerry", "ScreenConnect")
   or ServiceFileName has_any ("MSP360", "CloudBerry", "ScreenConnect")
| project TimeGenerated, Computer, Account, ServiceName, ServiceFileName, ServiceType, ServiceStartType
| sort by TimeGenerated desc

-- Hunt for unauthorized RMM artifacts: MSP360 and ScreenConnect
-- Targets running processes, services, and common install paths

LET processes = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(msp360|cloudberry|screenconnect)'
   OR Exe =~ '(?i)(msp360|cloudberry|screenconnect)'
   OR CommandLine =~ '(?i)(msp360|cloudberrylab|screenconnect)'

LET services = SELECT Name, DisplayName, PathName, StartMode, State
FROM wmi(query="SELECT Name, DisplayName, PathName, StartMode, State FROM Win32_Service", namespace="root/cimv2")
WHERE Name =~ '(?i)(msp360|cloudberry|screenconnect)'
   OR DisplayName =~ '(?i)(msp360|cloudberry|screenconnect)'
   OR PathName =~ '(?i)(msp360|cloudberry|screenconnect)'

LET binaries = SELECT FullPath, Size, Mtime
FROM glob(globs=[
  'C:/Program Files*/**/*MSP360*',
  'C:/Program Files*/**/*CloudBerry*',
  'C:/Program Files*/**/*ScreenConnect*',
  'C:/ProgramData/**/ScreenConnect*',
  'C:/Users/*/AppData/**/ScreenConnect*',
  'C:/Users/*/Downloads/**/*MSP360*'
])

SELECT * FROM processes
UNION ALL
SELECT NULL AS Pid, DisplayName AS Name, PathName AS CommandLine, FullPath AS Exe, StartMode AS Username, Mtime AS CreateTime FROM (
  SELECT NULL AS DisplayName, NULL AS PathName, NULL AS FullPath, NULL AS StartMode, NULL AS Mtime WHERE FALSE
)

#Requires -RunAsAdministrator
# audit-and-remove-unauthorized-rmm.ps1
# Audits for and optionally removes unauthorized MSP360 / ScreenConnect RMM artifacts
# Usage:  .\audit-and-remove-unauthorized-rmm.ps1                (audit only)
#         .\audit-and-remove-unauthorized-rmm.ps1 -Remediate      (audit + remove)

param(
    [switch]$Remediate = $false
)

$RmmPatterns = 'MSP360|CloudBerry|ScreenConnect'
$findings = @()

Write-Host "[*] Auditing services..." -ForegroundColor Cyan
$services = Get-CimInstance Win32_Service | Where-Object {
    $_.Name -match $RmmPatterns -or $_.DisplayName -match $RmmPatterns -or $_.PathName -match $RmmPatterns
}
foreach ($svc in $services) {
    $findings += [pscustomobject]@{ Type='Service'; Name=$svc.Name; Path=$svc.PathName; State=$svc.State }
    if ($Remediate) {
        Write-Host "[-] Stopping and removing service: $($svc.Name)" -ForegroundColor Yellow
        Stop-Service -Name $svc.Name -Force -ErrorAction SilentlyContinue
        sc.exe delete $svc.Name | Out-Null
    }
}

Write-Host "[*] Auditing running processes..." -ForegroundColor Cyan
$procs = Get-Process | Where-Object { $_.Name -match $RmmPatterns -or $_.Path -match $RmmPatterns }
foreach ($p in $procs) {
    $findings += [pscustomobject]@{ Type='Process'; Name=$p.Name; Path=$p.Path; State='Running' }
    if ($Remediate) {
        Write-Host "[-] Terminating process: $($p.Name) (PID $($p.Id))" -ForegroundColor Yellow
        Stop-Process -Id $p.Id -Force -ErrorAction SilentlyContinue
    }
}

Write-Host "[*] Auditing scheduled tasks..." -ForegroundColor Cyan
$tasks = Get-ScheduledTask | Where-Object {
    $_.TaskName -match $RmmPatterns -or ($_.Actions.Execute -match $RmmPatterns)
}
foreach ($t in $tasks) {
    $findings += [pscustomobject]@{ Type='ScheduledTask'; Name=$t.TaskName; Path=$t.Actions.Execute; State=$t.State }
    if ($Remediate) {
        Unregister-ScheduledTask -TaskName $t.TaskName -Confirm:$false -ErrorAction SilentlyContinue
    }
}

Write-Host "[*] Auditing installed programs..." -ForegroundColor Cyan
$uninstallPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$apps = Get-ItemProperty $uninstallPaths -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match $RmmPatterns }
foreach ($a in $apps) {
    $findings += [pscustomobject]@{ Type='InstalledApp'; Name=$a.DisplayName; Path=$a.InstallLocation; State='Installed' }
    if ($Remediate -and $a.UninstallString) {
        Write-Host "[-] Uninstalling: $($a.DisplayName)" -ForegroundColor Yellow
        # Review the uninstall string before executing in production
        Invoke-Expression $a.UninstallString
    }
}

Write-Host "[*] Auditing run keys for RMM persistence..." -ForegroundColor Cyan
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($rk in $runKeys) {
    Get-ItemProperty $rk -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty |
        Where-Object { $_.Definition -match $RmmPatterns } | ForEach-Object {
            $findings += [pscustomobject]@{ Type='RunKey'; Name=$_.Name; Path=$rk; State='Persistent' }
        }
}

Write-Host "`n===== FINDINGS =====" -ForegroundColor Green
if ($findings.Count -eq 0) {
    Write-Host "No MSP360/ScreenConnect artifacts found." -ForegroundColor Green
} else {
    $findings | Format-Table -AutoSize
    Write-Host "IMPORTANT: Validate each finding against your approved software inventory before removal." -ForegroundColor Red
    Write-Host "Unauthorized RMM presence = treat as a confirmed incident. Preserve evidence before remediation." -ForegroundColor Red
}