Ransomware Affiliates Weaponizing Legitimate RMM Software (ScreenConnect, AnyDesk, Atera) as Post-Compromise Access Tooling

// Detect execution of RMM client binaries not present on the org's sanctioned-RMM watchlist,
// with elevated risk when directly preceded by a Quick Assist / Remote Assistance session on
// the same device — the documented Storm-1811 / Black Basta help-desk vishing chain.
let LookbackWindow = 24h;
let CorrelationWindow = 4h;
let RMMBinaries = dynamic([
  "screenconnect.clientservice.exe", "screenconnect.windowsclient.exe", "screenconnect.clientlauncher.exe",
  "anydesk.exe", "ateraagent.exe", "srservice.exe", "srmanager.exe", "ststreamer.exe",
  "client32.exe", "pcicfgx.exe", "teamviewer.exe", "teamviewer_service.exe",
  "lmiguardiansvc.exe", "getscreen.exe", "rustdesk.exe", "gotoresolve.exe"
]);
let RemoteAssistPrecursors = dynamic(["quickassist.exe", "msra.exe"]);
let SanctionedRMM = (_GetWatchlist('ApprovedRMMTools') | project SearchKey);
let UnsanctionedRMMEvents = DeviceProcessEvents
| where Timestamp > ago(LookbackWindow)
| where FileName has_any (RMMBinaries)
| where FileName !in~ (SanctionedRMM)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, SHA256;
let QuickAssistSessions = DeviceProcessEvents
| where Timestamp > ago(LookbackWindow)
| where FileName has_any (RemoteAssistPrecursors)
| project QaTimestamp = Timestamp, DeviceName, QaProcess = FileName;
UnsanctionedRMMEvents
| join kind=leftouter QuickAssistSessions on DeviceName
| where isempty(QaProcess) or (Timestamp > QaTimestamp and Timestamp - QaTimestamp <= CorrelationWindow)
| extend HelpDeskVishingChain = isnotempty(QaProcess)
| extend RiskScore = iff(HelpDeskVishingChain, "Critical", "High")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, SHA256, QaProcess, QaTimestamp, HelpDeskVishingChain, RiskScore
| sort by RiskScore asc, Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\screenconnect.clientservice.exe" OR Image="*\\screenconnect.windowsclient.exe" OR
   Image="*\\anydesk.exe" OR Image="*\\ateraagent.exe" OR Image="*\\srservice.exe" OR
   Image="*\\client32.exe" OR Image="*\\teamviewer.exe" OR Image="*\\lmiguardiansvc.exe" OR
   Image="*\\rustdesk.exe" OR Image="*\\gotoresolve.exe")
| lookup approved_rmm_tools.csv image_name AS Image OUTPUT is_sanctioned
| where isnull(is_sanctioned)
| join type=left host [
    search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      (Image="*\\quickassist.exe" OR Image="*\\msra.exe")
    | rename _time as qa_time, Image as qa_image
    | table host, qa_time, qa_image
  ]
| eval HelpDeskVishingChain=if(isnotnull(qa_time) AND (_time - qa_time) <= 14400 AND (_time - qa_time) >= 0, 1, 0)
| eval RiskScore=if(HelpDeskVishingChain=1, "Critical", "High")
| table _time, host, User, Image, CommandLine, qa_image, qa_time, HelpDeskVishingChain, RiskScore
| sort - RiskScore, - _time

sequence by host.name with maxspan=4h
  [process where event.type == "start" and
    process.name : ("quickassist.exe", "msra.exe")]
  [process where event.type == "start" and
    process.name : ("screenconnect.clientservice.exe", "screenconnect.windowsclient.exe",
                     "anydesk.exe", "ateraagent.exe", "srservice.exe", "client32.exe",
                     "teamviewer.exe", "lmiguardiansvc.exe", "rustdesk.exe", "gotoresolve.exe")]

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  "Computer Name" AS host,
  username,
  "Process Name" AS process_name,
  "Command" AS command_line
FROM events
WHERE
  ("Event ID" = '1')
  AND (
    LOWER("Process Name") ILIKE '%screenconnect.clientservice.exe' OR
    LOWER("Process Name") ILIKE '%screenconnect.windowsclient.exe' OR
    LOWER("Process Name") ILIKE '%anydesk.exe' OR
    LOWER("Process Name") ILIKE '%ateraagent.exe' OR
    LOWER("Process Name") ILIKE '%srservice.exe' OR
    LOWER("Process Name") ILIKE '%client32.exe' OR
    LOWER("Process Name") ILIKE '%teamviewer.exe' OR
    LOWER("Process Name") ILIKE '%lmiguardiansvc.exe' OR
    LOWER("Process Name") ILIKE '%rustdesk.exe' OR
    LOWER("Process Name") ILIKE '%gotoresolve.exe'
  )
  AND NOT REFERENCESET("Process Name", 'Approved_RMM_Tools')
  AND LAST(devicetime) > NOW() - 86400000
ORDER BY devicetime DESC

_sourceCategory="os/windows/sysmon"
| where EventID = "1"
| parse regex field=_raw "(?i)Image[=:]\s*(?:[^\"\s]*\\\\)?(?P<image>[^\\\"\s\r\n]+)" nodrop
| where image matches /(?i)(screenconnect\.clientservice|screenconnect\.windowsclient|anydesk|ateraagent|srservice|client32|teamviewer|lmiguardiansvc|rustdesk|gotoresolve)\.exe/
| lookup approved_rmm_tools on image=tool_name
| where isNull(is_sanctioned)
| fields _messageTime, _sourceHost, image
| sort by _messageTime desc

rule unsanctioned_rmm_tool_execution {
  meta:
    author = "df00tech"
    description = "Detects execution of RMM client binaries not present on an approved-tooling reference list, the primary post-compromise access vector for Storm-1811/Black Basta-style intrusions."
    mitre_attack_tactic = "Resource Development"
    mitre_attack_technique = "T1588.002"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
    threat_actors = "Storm-1811, Black Basta affiliates"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.target.process.file.full_path = /(?i)(screenconnect\.clientservice\.exe|screenconnect\.windowsclient\.exe|anydesk\.exe|ateraagent\.exe|srservice\.exe|client32\.exe|teamviewer\.exe|lmiguardiansvc\.exe|rustdesk\.exe|gotoresolve\.exe)$/

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| FileName = /(?i)^(screenconnect\.clientservice|screenconnect\.windowsclient|anydesk|ateraagent|srservice|client32|teamviewer|lmiguardiansvc|rustdesk|gotoresolve)\.exe$/
| !in(field=FileName, values=$ApprovedRMMTools)
| select([@timestamp, ComputerName, UserName, FileName, CommandLine])
| sort(@timestamp, order=desc)