RMM Tool Abuse in the Wild: Detecting and Blocking Unauthorized Remote Access Software After ScreenConnect Campaigns

---
title: Unauthorized RMM Tool Execution
description: Detects execution of commonly abused remote access and RMM tooling. Tune the filter against your organization's sanctioned RMM products. Threat actors increasingly deploy signed RMM agents (ScreenConnect, AnyDesk, Atera, MeshCentral, Tactical RMM, RustDesk) as a persistence and C2 mechanism per MITRE T1219.
logsource:
  category: process_creation
  product: windows
detection:
  selection_rmm:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\AnyDesk.exe'
      - '\AteraAgent.exe'
      - '\Splashtop\Remote\Server\SRServer.exe'
      - '\tacticalrmm.exe'
      - '\meshagent.exe'
      - '\MeshCentral.exe'
      - '\rustdesk.exe'
      - '\dwservice.exe'
      - '\simplehelp.exe'
      - '\UltraVNC\winvnc.exe'
  filter_authorized:
    Image|startswith:
      - 'C:\Program Files\YourApprovedRMM\'
  condition: selection_rmm and not filter_authorized
falsepositives:
  - Sanctioned helpdesk and MSP tooling — build and maintain an authoritative allowlist before enabling
level: high
---
title: Silent RMM Agent Installation via Msiexec
description: Detects silent or unattended MSI installation of RMM agents, a common technique where attackers push vendor installers with quiet switches to avoid user-visible prompts.
logsource:
  category: process_creation
  product: windows
detection:
  selection_installer:
    Image|endswith: '\msiexec.exe'
    CommandLine|contains:
      - '/qn'
      - '/quiet'
      - '/passive'
  selection_payload:
    CommandLine|contains:
      - 'screenconnect'
      - 'anydesk'
      - 'atera'
      - 'splashtop'
      - 'meshcentral'
      - 'tactical'
      - 'rustdesk'
      - 'simplehelp'
  condition: all of selection_*
falsepositives:
  - Legitimate software deployment via SCCM/Intune/PSP — correlate with your deployment tooling's service accounts and source machines
level: high
---
title: RMM Agent Execution from User-Writable or Temporary Paths
description: Detects RMM and remote access binaries executing from user profiles, temp directories, or other non-standard install locations. Portable RMM executables dropped by attackers almost never land in Program Files.
logsource:
  category: process_creation
  product: windows
detection:
  selection_paths:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
      - '\Downloads\'
      - '$Recycle.Bin'
  selection_rmm_names:
    Image|endswith:
      - '\AnyDesk.exe'
      - '\ScreenConnect.ClientService.exe'
      - '\rustdesk.exe'
      - '\meshagent.exe'
      - '\TeamViewer.exe'
      - '\winvnc.exe'
  condition: all of selection_*
falsepositives:
  - Portable AnyDesk/TeamViewer quick-support sessions run by end users — investigate the initiating ticket or user request
level: high

// Hunt: Unauthorized RMM process execution across the fleet
// Maintain the AuthorizedRMM list to reflect YOUR sanctioned tooling
let AuthorizedRMM = dynamic(["YourApprovedRMM.exe"]);
let RMMNames = dynamic([
    "ScreenConnect.ClientService.exe", "ScreenConnect.WindowsClient.exe",
    "AnyDesk.exe", "AteraAgent.exe", "tacticalrmm.exe", "meshagent.exe",
    "rustdesk.exe", "dwservice.exe", "simplehelp.exe", "winvnc.exe",
    "SRServer.exe", "TeamViewer_Service.exe"
]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ (RMMNames) and FileName !in~ (AuthorizedRMM)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    CommandLines = make_set(ProcessCommandLine, 5),
    InitiatingAccounts = make_set(InitiatingProcessAccountName, 5)
    by DeviceName, FileName, FolderPath, SHA256
| extend SuspiciousPath = FolderPath has_any ("Temp", "Public", "Downloads", "Roaming", "ProgramData")
| sort by SuspiciousPath desc, FirstSeen asc;

// Hunt: Network connections to RMM vendor infrastructure
// Useful where process telemetry is gapped; catches agent beaconing
let RMMDomains = dynamic([
    "screenconnect.com", "anydesk.com", "anydesk.net",
    "atera.com", "splashtop.com", "meshcentral.com",
    "rustdesk.com", "simple-help.com", "dwservice.net"
]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (RMMDomains)
| summarize Connections = count(), FirstSeen = min(TimeGenerated),
    RemoteIPs = make_set(RemoteIP, 10), Ports = make_set(RemotePort, 10)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl
| order by Connections desc;

-- Hunt for unauthorized RMM agent processes and their network connections
-- Deploy as a fleet-wide hunt; review hits against your sanctioned RMM allowlist
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(screenconnect|anydesk|atera|tacticalrmm|meshagent|rustdesk|dwservice|simplehelp|winvnc|teamviewer)'
   OR Exe =~ '(?i)(screenconnect|anydesk|atera|tactical|mesh|rustdesk)'

-- Hunt for RMM persistence artifacts: services registered by remote access tooling
SELECT Name, DisplayName, PathName, StartName, StartMode, State
FROM wmi_query(namespace='root/cimv2',
               query='SELECT Name, DisplayName, PathName, StartName, StartMode, State FROM Win32_Service')
WHERE PathName =~ '(?i)(screenconnect|anydesk|atera|splashtop|meshagent|rustdesk|dwservice|simplehelp)'

# ============================================================
# Audit-and-Remove: Unauthorized RMM Tooling
# Run elevated. STEP 1 = audit only. Set $Remediate = $true to remove.
# ============================================================
$Remediate = $false   # Flip to $true ONLY after reviewing audit output
$AuthorizedRMM = @()  # e.g. @('YourApprovedRMM') — names to EXCLUDE from action

$RMMPatterns = @(
    'ScreenConnect','AnyDesk','Atera','Splashtop','TacticalRMM',
    'MeshCentral','RustDesk','DWService','SimpleHelp','UltraVNC',
    'LogMeIn','GoToMyPC','N-able','Take Control'
)

# --- 1. Audit installed software (both registry hives) ---
$uninstallKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$installed = Get-ItemProperty $uninstallKeys -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -and ($RMMPatterns | ForEach-Object { $_ } | Where-Object { $false }) -eq $null }  # placeholder guard
$installed = Get-ItemProperty $uninstallKeys -ErrorAction SilentlyContinue |
    Where-Object { $d = $_.DisplayName; $d -and ($RMMPatterns | Where-Object { $d -match [regex]::Escape($_) }) } |
    Select-Object DisplayName, DisplayVersion, Publisher, InstallDate, UninstallString, PSPath

# --- 2. Audit running processes and services ---
$procs = Get-Process | Where-Object { $n = $_.Name; $RMMPatterns | Where-Object { $n -match $_ } } |
    Select-Object Name, Id, Path
$services = Get-CimInstance Win32_Service |
    Where-Object { $p = $_.PathName; $p -and ($RMMPatterns | Where-Object { $p -match $_ }) } |
    Select-Object Name, DisplayName, State, StartMode, PathName

Write-Host "=== INSTALLED RMM SOFTWARE ==="; $installed | Format-Table -AutoSize
Write-Host "=== RUNNING RMM PROCESSES ===";   $procs     | Format-Table -AutoSize
Write-Host "=== RMM SERVICES ===";            $services  | Format-Table -AutoSize
$installed,$procs,$services | Export-Csv ".\RMM_Audit_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation

# --- 3. Optional remediation: stop services, kill processes, uninstall ---
if ($Remediate) {
    foreach ($svc in $services) {
        $isAuth = $AuthorizedRMM | Where-Object { $svc.DisplayName -match $_ }
        if (-not $isAuth) {
            Stop-Service -Name $svc.Name -Force -ErrorAction SilentlyContinue
            Set-Service  -Name $svc.Name -StartupType Disabled -ErrorAction SilentlyContinue
            Write-Host "[+] Disabled service: $($svc.Name)"
        }
    }
    foreach ($p in $procs) {
        $isAuth = $AuthorizedRMM | Where-Object { $p.Name -match $_ }
        if (-not $isAuth) { Stop-Process -Id $p.Id -Force -ErrorAction SilentlyContinue }
    }
    foreach ($app in $installed) {
        $isAuth = $AuthorizedRMM | Where-Object { $app.DisplayName -match $_ }
        if (-not $isAuth -and $app.UninstallString -match 'msiexec') {
            $guid = [regex]::Match($app.UninstallString,'\{[0-9A-Fa-f-]+\}').Value
            Start-Process msiexec.exe -ArgumentList "/x $guid /qn /norestart" -Wait
            Write-Host "[+] Uninstalled: $($app.DisplayName)"
        }
    }
}