RMM Social Engineering Campaign Hits 46 Countries — US Is Top Target: Detection and Defense Guide

---
title: Unauthorized RMM Tool Execution
description: Detects execution of commonly abused remote monitoring and management tools. Tune the filter section against your organization's sanctioned RMM/remote access stack. High-fidelity when combined with an RMM allowlist.
author: Security Arsenal
date: 2026/09/15
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\anydesk.exe'
      - '\screenconnect.client.exe'
      - '\screenconnect.windowsclient.exe'
      - '\teamviewer.exe'
      - '\teamviewer_service.exe'
      - '\atera_agent.exe'
      - '\splashtop_streamer.exe'
      - '\sr_manager.exe'
      - '\nable_agent.exe'
      - '\rmm.exe'
      - '\rustdesk.exe'
      - '\ultraviewer.exe'
      - '\netop.exe'
      - '\dwrcs.exe'
      - '\lmsvc.exe'
      - '\logmein.exe'
  filter_sanctioned_paths:
    Image|startswith:
      - 'C:\Program Files\YourSanctionedRMM\'
      - 'C:\Program Files (x86)\YourSanctionedRMM\'
  condition: selection_img and not filter_sanctioned_paths
falsepositives:
  - IT-sanctioned remote support tooling — maintain and enforce the allowlist filter
level: high
---
title: RMM Installer Dropped in User-Writable Directory
description: Detects RMM-related executables written to user-writable locations (Downloads, Temp, AppData, Public), a hallmark of socially engineered installs where victims are lured into running the agent themselves rather than IT deploying it via standard channels.
author: Security Arsenal
date: 2026/09/15
status: experimental
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - 'C:\Users\Public\'
      - 'C:\ProgramData\Microsoft\Crypto\'
  selection_name:
    TargetFilename|contains:
      - 'anydesk'
      - 'screenconnect'
      - 'teamviewer'
      - 'atera'
      - 'splashtop'
      - 'rustdesk'
      - 'ultraviewer'
      - 'netsupport'
      - 'logmein'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.msi'
  condition: selection_path and selection_name and selection_ext
falsepositives:
  - Users self-installing IT-approved remote tools — enforce deployment via software distribution instead
level: high
---
title: Phishing Lure Masquerading as Tax Document Installer
description: Detects execution of installers from user directories whose filenames mimic tax or revenue-agency documents — consistent with CRA tax-form lure tradecraft observed in this campaign.
author: Security Arsenal
date: 2026/09/15
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - 'C:\Users\Public\'
  selection_name:
    Image|contains:
      - 'cra'
      - 'tax'
      - 'refund'
      - 'revenue'
      - 't4'
      - 'w2'
      - 'w-2'
      - '1099'
      - 'irs'
  selection_ext:
    Image|endswith:
      - '.exe'
      - '.msi'
      - '.scr'
      - '.bat'
      - '.cmd'
  condition: selection_path and selection_name and selection_ext
falsepositives:
  - Rare — legitimate tax software is typically installed to Program Files by an administrator, not run from Downloads
level: critical

// Hunt: RMM tooling executed from user-writable paths + outbound RMM vendor connections
// Scope: last 14 days. Tune RmmVendors/RmmBinaries to your environment's allowlist.
let RmmBinaries = dynamic(["anydesk.exe","screenconnect.client.exe","screenconnect.windowsclient.exe","teamviewer.exe","atera_agent.exe","splashtop_streamer.exe","rustdesk.exe","ultraviewer.exe","logmein.exe","netsupport.exe","sr_manager.exe","dwrcs.exe"]);
let RmmVendorDomains = dynamic(["anydesk.com","screenconnect.com","connectwise.com","teamviewer.com","atera.com","splashtop.com","rustdesk.com","ultraviewer.net","logmein.com","netsupportsoftware.com"]);
let SuspiciousProcs =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName in~ (RmmBinaries)
    | where FolderPath has_any ("\\Downloads\\","\\AppData\\","\\Users\\Public\\","\\Temp\\")
    | project DeviceId, DeviceName, ProcTime=TimeGenerated, FileName, FolderPath,
              ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine,
              AccountName, SHA256;
SuspiciousProcs
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (RmmVendorDomains)
    | project DeviceId, NetTime=TimeGenerated, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName
) on DeviceId
| where isnotempty(RemoteUrl) or isnotempty(FileName)
| summarize FirstSeen=min(ProcTime), LastSeen=max(ProcTime),
            RmmProcesses=make_set(FileName), CommandLines=make_set(ProcessCommandLine),
            VendorConnections=make_set(RemoteUrl), RemoteIPs=make_set(RemoteIP),
            LaunchedBy=make_set(InitiatingProcessFileName), Users=make_set(AccountName)
        by DeviceName
| order by FirstSeen desc

// Hunt: Tax-themed phishing lures (CRA/IRS/refund) delivered in the same window
EmailEvents
| where TimeGenerated > ago(14d)
| where Subject has_any ("CRA","Canada Revenue","tax refund","tax reassessment","T4","W-2","W2","1099","IRS","refund status")
   or AttachmentFileNames has_any ("cra","tax","refund","revenue","t4","w2","1099","irs")
| where MalwareFilterVerdict !~ "Malware"   // the lure is often a link, not a payload — AV-clean
| project TimeGenerated, SenderFromAddress, SenderMailFromAddress, RecipientEmailAddress,
          Subject, AttachmentFileNames, Urls, DeliveryAction, ThreatTypes
| order by TimeGenerated desc

-- Artifact: RMM abuse triage — running RMM processes, persistence, and connections
-- Scope with a hunt across the fleet; export results per host for case evidence.

-- 1. Running RMM processes with command lines and owners
LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(anydesk|screenconnect|teamviewer|atera|splashtop|rustdesk|ultraviewer|logmein|netsupport)'
   OR CommandLine =~ '(?i)(anydesk|screenconnect|teamviewer|atera|splashtop|rustdesk|ultraviewer|logmein|netsupport)'

-- 2. RMM binaries on disk outside Program Files (user-writable staging)
LET staged = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Users/*/Downloads/**/*anydesk*.exe',
                 'C:/Users/*/Downloads/**/*screenconnect*.exe',
                 'C:/Users/*/Downloads/**/*teamviewer*.exe',
                 'C:/Users/*/Downloads/**/*rustdesk*.exe',
                 'C:/Users/*/Downloads/**/*ultraviewer*.exe',
                 'C:/Users/*/AppData/**/*anydesk*.exe',
                 'C:/Users/*/AppData/**/*screenconnect*.exe',
                 'C:/Users/Public/**/*.exe'])
WHERE FullPath =~ '(?i)(anydesk|screenconnect|teamviewer|atera|splashtop|rustdesk|ultraviewer|logmein)'
   OR FullPath =~ '(?i)Users/Public'

-- 3. Persistence: services registered for RMM agents
LET services = SELECT Name, DisplayName, PathName, StartMode, State
FROM wmi(query='SELECT Name, DisplayName, PathName, StartMode, State FROM Win32_Service',
         namespace='root/cimv2')
WHERE PathName =~ '(?i)(anydesk|screenconnect|teamviewer|atera|splashtop|rustdesk|ultraviewer|logmein|netsupport)'

SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'STAGED_FILE' AS Name, FullPath AS Exe,
       format(format='Size=%d Mtime=%v', args=[Size, Mtime]) AS CommandLine,
       '' AS Username, Ctime AS CreateTime FROM staged

#Requires -RunAsAdministrator
# Security Arsenal — Unauthorized RMM Audit & Removal
# 1) Populate $SanctionedRmm with YOUR approved tool names before running.
# 2) Run with -ReportOnly first. Review output. Then rerun without it to remediate.

param([switch]$ReportOnly)

$SanctionedRmm = @('datto','kaseya')   # <-- EDIT: names of your approved RMM(s), lowercase
$KnownRmmPatterns = @('anydesk','screenconnect','connectwise','teamviewer','atera',
                      'splashtop','rustdesk','ultraviewer','logmein','netsupport',
                      'dameware','dwrcs','n-able','nble','gotomypc','zoho','ammyy')
$Report = @()

function Test-Sanctioned([string]$Name) {
    foreach ($ok in $SanctionedRmm) { if ($Name.ToLower() -like "*$ok*") { return $true } }
    return $false
}

Write-Host "[*] Auditing running processes..." -ForegroundColor Cyan
Get-Process | Where-Object {
    $p = $_.ProcessName.ToLower()
    ($KnownRmmPatterns | Where-Object { $p -like "*$_*" }) -and -not (Test-Sanctioned $p)
} | ForEach-Object {
    $Report += [pscustomobject]@{Type='Process'; Name=$_.ProcessName; Path=$_.Path; Action=''}
    Write-Host "[!] Unauthorized RMM process: $($_.ProcessName) ($($_.Path))" -ForegroundColor Red
    if (-not $ReportOnly) { Stop-Process -Id $_.Id -Force -ErrorAction SilentlyContinue; $Report[-1].Action='Terminated' }
}

Write-Host "[*] Auditing services..." -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object {
    $n = ($_.Name + $_.DisplayName + $_.PathName).ToLower()
    ($KnownRmmPatterns | Where-Object { $n -like "*$_*" }) -and -not (Test-Sanctioned $n)
} | ForEach-Object {
    $Report += [pscustomobject]@{Type='Service'; Name=$_.Name; Path=$_.PathName; Action=''}
    Write-Host "[!] Unauthorized RMM service: $($_.Name) -> $($_.PathName)" -ForegroundColor Red
    if (-not $ReportOnly) {
        Stop-Service -Name $_.Name -Force -ErrorAction SilentlyContinue
        sc.exe delete $_.Name | Out-Null
        $Report[-1].Action='Stopped+Deleted'
    }
}

Write-Host "[*] Auditing installed programs..." -ForegroundColor Cyan
$uninstall = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
             'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
Get-ItemProperty $uninstall -ErrorAction SilentlyContinue | Where-Object {
    $d = "$($_.DisplayName)".ToLower()
    ($KnownRmmPatterns | Where-Object { $d -like "*$_*" }) -and -not (Test-Sanctioned $d)
} | ForEach-Object {
    $Report += [pscustomobject]@{Type='InstalledApp'; Name=$_.DisplayName; Path=$_.InstallLocation; Action='Manual uninstall required'}
    Write-Host "[!] Unauthorized RMM installed: $($_.DisplayName)" -ForegroundColor Red
}

Write-Host "[*] Auditing staged binaries in user-writable paths..." -ForegroundColor Cyan
Get-ChildItem 'C:\Users\*\Downloads','C:\Users\Public' -Recurse -Include *.exe,*.msi -ErrorAction SilentlyContinue |
  Where-Object { $n=$_.Name.ToLower(); $KnownRmmPatterns | Where-Object { $n -like "*$_*" } } |
  ForEach-Object {
    $Report += [pscustomobject]@{Type='StagedFile'; Name=$_.Name; Path=$_.FullName; Action=''}
    Write-Host "[!] Staged RMM installer: $($_.FullName)" -ForegroundColor Red
    if (-not $ReportOnly) { Remove-Item $_.FullName -Force -ErrorAction SilentlyContinue; $Report[-1].Action='Deleted' }
  }

$out = "$env:ProgramData\RMM_Audit_$(Get-Date -Format yyyyMMdd_HHmmss).csv"
$Report | Export-Csv $out -NoTypeInformation
Write-Host "[*] Report written to $out — $($Report.Count) finding(s). Preserve for IR case evidence." -ForegroundColor Green