RMM Phishing Campaign (Fake CRA T4 / SSA Lures): Living-Off-the-Land RMM Abuse — OTX Pulse Detection Pack

---
title: Unauthorized RMM Tool Execution (ScreenConnect / AnyDesk / TeamViewer Class)
id: 7f3a2c1e-9b4d-4e6a-a1c2-rmmphish0001
status: experimental
description: Detects execution of commonly abused legitimate RMM binaries consistent with phishing-delivered RMM campaigns (CRA T4 / SSA lure tradecraft). Tune allowlist to your approved RMM tooling.
author: Security Arsenal Threat Intel
references:
  - https://any.run/cybersecurity-blog/us-campaign-malware-analysis
date: 2026/08/26
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\screenconnect.clientservice.exe'
      - '\screenconnect.windowsclient.exe'
      - '\anydesk.exe'
      - '\teamviewer.exe'
      - '\teamviewer_service.exe'
      - '\rustdesk.exe'
      - '\ammyy.exe'
      - '\aeroadmin.exe'
      - '\splashtop.exe'
      - '\netop.exe'
  filter_approved_paths:
    Image|startswith:
      - 'C:\Program Files\ApprovedRMM\'
  condition: selection_img and not filter_approved_paths
falsepositives:
  - Legitimate IT helpdesk RMM usage — maintain an approved-path/process allowlist
level: high
tags:
  - attack.command_and_control
  - attack.t1219
---
title: Password-Protected Archive Extraction Followed by Installer Execution
id: 8a4b3d2f-1c5e-4f7b-b2d3-rmmphish0002
status: experimental
description: Detects extraction utilities or Explorer spawning MSI/installer processes shortly after archive handling — pattern typical of password-protected ZIP phishing lures delivering RMM installers.
author: Security Arsenal Threat Intel
references:
  - https://any.run/cybersecurity-blog/us-campaign-malware-analysis
date: 2026/08/26
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\7z.exe'
      - '\winrar.exe'
      - '\winzip.exe'
  selection_child:
    Image|endswith:
      - '\msiexec.exe'
      - '\setup.exe'
      - '\install.exe'
  selection_cmd:
    CommandLine|contains:
      - 'Downloads'
      - 'Temp'
      - 'AppData\Local\Temp'
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
  - User-installed software from Downloads — correlate with email/proxy telemetry for phishing context
level: medium
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
---
title: Suspicious Outbound Connection to Known RMM Phishing Infrastructure
id: 9c5d4e3a-2d6f-5a8c-c3e4-rmmphish0003
status: experimental
description: Detects DNS/network connections to infrastructure identified in the OTX RMM phishing pulse, including dynamic-DNS relays and throwaway .vu domains.
author: Security Arsenal Threat Intel
date: 2026/08/26
logsource:
  category: dns
  product: windows
detection:
  selection:
    query|contains:
      - 'dashboarduat.paynnow.com'
      - 'dcsi23.swoop2.me'
      - 'ssi11.letsgo2.me'
      - 'swoop2.me'
      - 'hiltonheadislanddeals.com'
      - 'quavix.vu'
      - 'cevora.vu'
      - 'xorlira.vu'
  condition: selection
falsepositives:
  - None expected; these are campaign-specific indicators
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.001

// Hunt: RMM phishing campaign — IOC matches + unauthorized RMM process/network behavior
let lookback = 90d;
let iocs = dynamic(["dashboarduat.paynnow.com","dcsi23.swoop2.me","ssi11.letsgo2.me","swoop2.me","hiltonheadislanddeals.com","quavix.vu","cevora.vu","xorlira.vu"]);
let rmmProcs = dynamic(["screenconnect.clientservice.exe","screenconnect.windowsclient.exe","anydesk.exe","teamviewer.exe","teamviewer_service.exe","rustdesk.exe","splashtop.exe","aeroadmin.exe","netop.exe"]);
let NetHits = DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where RemoteUrl has_any (iocs)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
let ProcHits = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName in~ (rmmProcs)
| project Timestamp, DeviceName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;
let RecentRMMInstalls = DeviceEvents
| where Timestamp > ago(lookback)
| where ActionType == "ServiceInstalled"
| extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName)
| where ServiceName has_any ("screenconnect","anydesk","teamviewer","rustdesk","splashtop")
| project Timestamp, DeviceName, ServiceName, InitiatingProcessFileName;
union NetHits, ProcHits
| sort by Timestamp desc;
RecentRMMInstalls
| sort by Timestamp desc

# Security Arsenal - RMM Phishing Campaign IOC & Artifact Hunt (Windows endpoints)
# Run via EDR Live Response / RMM-of-record / GPO. Requires admin for service & all-user checks.

$iocDomains = @('dashboarduat.paynnow.com','dcsi23.swoop2.me','ssi11.letsgo2.me','swoop2.me','hiltonheadislanddeals.com','quavix.vu','cevora.vu','xorlira.vu')
$rmmNames   = @('ScreenConnect','AnyDesk','TeamViewer','RustDesk','AeroAdmin','Splashtop','NetSupport','Netop')
$findings   = @()

# 1) Unauthorized RMM services (persistence)
Get-CimInstance Win32_Service | Where-Object {
    $n = $_.Name + ' ' + $_.DisplayName + ' ' + $_.PathName
    $rmmNames | Where-Object { $n -match $_ }
} | ForEach-Object {
    $findings += [pscustomobject]@{Type='Service'; Detail="$($_.Name) | $($_.DisplayName) | $($_.PathName) | State=$($_.State)"}
}

# 2) Run-key persistence for RMM agents (HKLM + all user hives)
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($rk in $runKeys) {
    if (Test-Path $rk) {
        (Get-ItemProperty $rk).PSObject.Properties | Where-Object {
            $rmmNames | Where-Object { "$($_.Value)" -match $_ }
        } | ForEach-Object {
            $findings += [pscustomobject]@{Type='RunKey'; Detail="$rk :: $($_.Name) = $($_.Value)"}
        }
    }
}

# 3) Running RMM processes
Get-Process | Where-Object { $rmmNames | Where-Object { $_.Name -match "^$_" } } | ForEach-Object {
    $findings += [pscustomobject]@{Type='Process'; Detail="$($_.Name) (PID $($_.Id)) Path=$($_.Path)"}
}

# 4) DNS cache & active connections matching campaign IOCs
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $iocDomains) {
    $hits = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    foreach ($h in $hits) { $findings += [pscustomobject]@{Type='DNSCache'; Detail="$($h.Entry) -> $($h.Data)"} }
}
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction Stop
        if ($rmmNames | Where-Object { $proc.Name -match $_ }) {
            $findings += [pscustomobject]@{Type='NetConnection'; Detail="$($proc.Name) (PID $($_.OwningProcess)) -> $($_.RemoteAddress):$($_.RemotePort)"}
        }
    } catch {}
}

# 5) Recent MSI installs of RMM products (install artifact)
Get-CimInstance Win32_Product -ErrorAction SilentlyContinue | Where-Object {
    $rmmNames | Where-Object { $_.Name -match $_ }
} | ForEach-Object {
    $findings += [pscustomobject]@{Type='InstalledProduct'; Detail="$($_.Name) | InstallDate=$($_.InstallDate)"}
}

if ($findings.Count -gt 0) {
    Write-Host "[ALERT] $($findings.Count) potential RMM-phishing artifacts on $env:COMPUTERNAME" -ForegroundColor Red
    $findings | Format-Table -AutoSize
    $findings | Export-Csv -NoTypeInformation -Path "$env:TEMP\rmm_hunt_$env:COMPUTERNAME.csv"
} else {
    Write-Host "[CLEAN] No RMM-phishing artifacts detected on $env:COMPUTERNAME" -ForegroundColor Green
}