Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-RMM-UnauthorizedToolDeployment.
Upgrade to ProDetect Ransomware Affiliates Weaponizing Legitimate RMM Software (ScreenConnect, AnyDesk, Atera) as Post-Compromise Access Tooling in Google Chronicle
Rather than developing custom malware, ransomware affiliates and initial access brokers increasingly obtain commercially available, code-signed Remote Monitoring and Management (RMM) software — ScreenConnect, AnyDesk, Atera, Splashtop, NetSupport Manager — for use as post-compromise remote-access tooling. Because these tools are legitimate, digitally signed, and widely deployed by managed service providers, they are frequently absent from allowlists built around known-malicious binaries (Mimikatz, Cobalt Strike, PsExec) and evade signature-based AV/EDR detection entirely. The documented Storm-1811/Black Basta chain (CISA AA23-325A) begins with email-bombing a victim with spam, then a threat actor impersonating IT/helpdesk staff calls the victim and talks them into opening Microsoft Quick Assist (quickassist.exe) or Windows Remote Assistance (msra.exe) to grant screen control; the actor then installs ScreenConnect or AnyDesk through that session to establish durable, unauthorized remote access before deploying ransomware. Detection therefore pivots from the acquisition itself (which occurs outside the victim environment via a legitimate vendor download/trial signup) to observing the installation and execution of RMM binaries that are not present on the organization's sanctioned-tooling allowlist, with highest confidence when that installation is directly preceded by a Quick Assist or Remote Assistance session on the same endpoint.
MITRE ATT&CK
- Tactic
- Resource Development
YARA-L Detection Query
rule unsanctioned_rmm_tool_execution {
meta:
author = "df00tech"
description = "Detects execution of RMM client binaries not present on an approved-tooling reference list, the primary post-compromise access vector for Storm-1811/Black Basta-style intrusions."
mitre_attack_tactic = "Resource Development"
mitre_attack_technique = "T1588.002"
severity = "HIGH"
priority = "HIGH"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
threat_actors = "Storm-1811, Black Basta affiliates"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
$e.target.process.file.full_path = /(?i)(screenconnect\.clientservice\.exe|screenconnect\.windowsclient\.exe|anydesk\.exe|ateraagent\.exe|srservice\.exe|client32\.exe|teamviewer\.exe|lmiguardiansvc\.exe|rustdesk\.exe|gotoresolve\.exe)$/
condition:
$e
}Chronicle YARA-L 2.0 rule matching PROCESS_LAUNCH UDM events for known RMM client binaries. Chronicle reference lists should be used at the rule-deployment layer to suppress matches for the organization's approved RMM tooling; unsuppressed matches should be correlated against quickassist.exe/msra.exe PROCESS_LAUNCH events on the same principal.asset within the preceding 4 hours to identify the help-desk vishing variant of this scenario.
Data Sources
Required Tables
False Positives & Tuning
- Reference list not yet updated with the organization's currently approved RMM vendor
- Personal or unrelated legitimate use of the listed remote-access clients
Other platforms for THREAT-RMM-UnauthorizedToolDeployment
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Quick Assist Followed by Unsanctioned RMM Binary Launch
Expected signal: Sysmon Event ID 1 / Security Event ID 4688: process creation for quickassist.exe (renamed notepad.exe copy) followed approximately 5 seconds later by process creation for anydesk.exe (renamed notepad.exe copy), both under the test account on the same host.
- Test 2Unsanctioned RMM Binary Execution Without Prior Remote-Assist Session
Expected signal: Sysmon Event ID 1 / Security Event ID 4688: process creation for ateraagent.exe (renamed notepad.exe copy), with no preceding quickassist.exe or msra.exe event on the same host.
References (4)
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-RMM-UnauthorizedToolDeployment — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month